Cosmos Hub Halts After Neutron Governance Attack Drains $9.5M
Cosmos (ATOM)
Editor:
Eugene Serbin
Cosmos Hub stopped block production on Tuesday following a governance attack on Neutron that drained $9.5 million from two applications. The attacker spent just $20,199 on NTRN tokens to pass a proposal named “AI Agent Takeover,” which granted control over Astroport and Drop. From Astroport, $4.9 million was extracted, while another $4.4 million left Drop.
Neutron paused quickly, trapping roughly $5 million in assets, while Cosmos Hub validators halted the chain to freeze 1.2 million ATOM worth over $2.2 million from the attacker’s address. Only about 20% of the stolen funds actually moved, leaving the rest trapped in the halted networks. Block production resumed at 12:00 UTC on Wednesday, September 23, with a plan to refund the trapped ATOM balance.
This marks the third security scare for the ecosystem recently, following a bug in Cosmos Labs’ EVM module that KiiChain criticized for causing a $9 million loss. Additionally, Osmosis revealed an exploit on June 25 involving unauthorized minting on Nomic’s bridge. The incident highlights vulnerabilities in decentralized governance where low proposal costs allow malicious actors to take control of live applications. The attacker’s Ethereum address currently holds $1.8 million, with $300,000 pending on THORChain to be refunded to Cosmos Hub.
How the market reacted
Whalio's own Binance spot order flow for ATOM, measured when this story was written up on 23 September 2026. Not the outlet's figures.
ATOM is trading at $1.85 with a 24-hour buy ratio of 50.1%, indicating balanced buying and selling pressure over the day. Short-term sentiment shows slight bearishness, with the 1-hour buy ratio at 47.6% and the 4-hour ratio at 49.7%, both below the daily average. Volume deltas reflect this shift, showing -$3,515 in the last hour and -$8,262 over four hours, contrasting with a positive +$3,532 delta for the full 24 hours. The Cumulative Volume Delta (CVD) closed at -$95,736, suggesting that recent selling pressure has outweighed buying in the immediate term. This indicates that while daily volume was healthy, the most recent flow has turned net negative as traders reacted to the news.
The latest daily buy ratio of 44.7% sits at the 9th percentile of the last 322 days, against a median of 49.8% - among the weakest buying days it has had.
Was that an ordinary day?
The same Binance spot measurements for ATOM, averaged over the days leading up to the story.
Over the preceding week, ATOM saw a 21.6% price increase and traded at 1.43 times its average volume, signaling a period of heightened activity. However, today’s 24-hour buy ratio of 50.1% is slightly below the weekly average of 51.1%, showing a marginal cooling in buying intensity. The coin experienced net buying on five of the last seven days, with a total volume delta of +$452,198 for the period. While the broader trend remains bullish with significant volume expansion, the current short-term metrics suggest a pause in the aggressive accumulation seen earlier in the week.