🩸 Cosmos froze its own chain to claw back the loot — refunds still hostage to a vote

Sept 22: an attacker voted his way into admin control on Neutron, bridged part of the loot over to the Cosmos Hub — and got his ass handed back. Hub validators halted the chain and yanked 1,227,121.37 ATOM into a recovery multisig. Sounds like a happy ending? Yeah, no: the six signers sitting on that pile won't move a coin until the Hub passes a governance vote. Welcome to crypto, where the rescue is also a governance hostage situation.

▪️ Not a code bug: a Neutron governance proposal on Sept 22 handed the attacker admin control over contracts used by Astroport and other protocols. Read that twice — governance itself did the robbing.
▪️ He bridged the loot across chains, roughly 1.73M ATOM onto the Hub. The Hub was never exploited — it was just where part of the pile could still be grabbed.
▪️ Validators halted the Hub, restarted Sept 23 on patched Gaia v28.3.0; the first block after the halt moved the ATOM to the multisig at 12:06 UTC.
▪️ The patch hit only that one source account — no other balances or delegations touched. Binary tested on a fork of mainnet state, shipped with a checksum.
▪️ Source diff was withheld: publishing it would expose v28.2.0 fixes under a coordinated disclosure embargo. Cosmos Labs said it'd publish once that lifted.
▪️ Signers: Nansen, Keplr, Enigma, Silknodes, Kiln, Polkachu — they want a passed Hub proposal before releasing anything, and Cosmos Labs holds no key.

📊 Hub halt height: 33,086,740
📊 Validator voting power behind the patch: over 67%
📊 Signatures needed to move the multisig: 4 of 6

Two kinds of control here, and retail eats the gap: a validator supermajority changed Hub state to stop the bleeding, but the custody crew won't name a destination without a public mandate. At 15:40 UTC on Sept 26 the Hub's proposal list showed no passed mandate — 1056, "ATOM Refund & Justice Bounty," was still in voting and wanted a different refund and bounty anyway. Neutron relaunched with mitigations by Sept 25; Astroport, Drop and other affected protocols are still stacking evidence on what was taken. The response team was expected to bring or back a Hub proposal in the following week. So: chain unfrozen in a day, victims still waiting on a vote that isn't even on the board yet. Same movie every time.

🔮 Freezing a chain takes six minutes. Paying victims needs a vote nobody has scheduled. Guess which one drags out.

@pixeos