Neutron governance takeover (2026-09-22): attacker's Cosmos Hub address per Cosmos Labs, plus Neutron, Noble and Ethereum wallets
- Scam type: Hack
- Chain: Cosmos ecosystem (Cosmos Hub)
- Project or site name: Neutron (Astroport, Drop)
- Incident date: 2026-09-22
- Reported: 2026-10-23
- Last updated: 2026-10-23
On 2026-09-22 a governance proposal on Neutron passed and gave its author admin control over contracts of Astroport and other protocols, which were then drained. Neutron and the Cosmos Hub were halted. About 1.73M ATOM of the proceeds reached the Cosmos Hub, and Cosmos Hub validators later moved 1,227,121 ATOM from the attacker's Hub address into a recovery multisig. Primary source: Cosmos Labs, "Neutron Governance Attack: Cosmos Hub Response and Recovery Update", 2026-09-25 (https://forum.cosmos.network/t/neutron-governance-attack-cosmos-hub-response-and-recovery-update/17369). It names the…
Other addresses in this report: neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605, noble1dd25c4sshelrpfs0433apg24c5phrhk8nx0sda, 0xe149310eb8b1b3d9c471ccd81819d393621fba5c, 0xef6c5a31df984c8569236a0abc1f27580e2a5d54