Cosmos intercepts 1.23 million stolen ATOM but refunds now wait on governance vote

An attacker moved roughly 1.73 million stolen ATOM from Neutron to the Cosmos Hub during a Sept. 22 governance attack. Hub validators secured 1,227,121.37 ATOM of that flow in an emergency software patch, but the six signers holding it say a separate Hub governance proposal must pass before they release the funds to affected users and protocols.That condition, detailed in a Sept. 25 account from Cosmos Labs, separates the emergency action validators took to prevent further outflows from the decision over who should receive the money. The recovery address held 1,227,121.374688 ATOM in a Hub balance query at 15:40 UTC on Sept. 26. The tokens were in custody, while Cosmos Labs said the Neutron response team was still preparing the evidence and distribution plan that would support a return.How validators secured the ATOMThe attack began on Neutron on Sept. 22, when a governance proposal gave the attacker administrative control over contracts used by Astroport and other protocols, according to the Hub maintainers. The attacker moved some of the stolen assets to other networks, including roughly 1.73 million ATOM to the Cosmos Hub. The Hub itself was not exploited; it became the place wh...