Cosmos Hub Validators Recover 1.23 Million ATOM After Governance Attack

The recovery effort involved a coordinated software update, Gaia v28.3.0, which migrated the stolen funds to a multi-signature wallet controlled by six community validators, including representatives from Coinbase and Kraken. Under this arrangement, four of the six signers must approve any movement of the assets. While this action saved a significant portion of the stolen capital, the attacker had already swapped approximately 500,000 ATOM for ETH via THORChain before the network pause took effect. An additional 168,990 ATOM reached the attacker’s address shortly after the restart and was subsequently liquidated on Osmosis.

Cosmos Labs confirmed that the Hub itself remained secure and user funds were not directly compromised. The secured 1.23 million ATOM currently sit in the recovery wallet, frozen against staking or trading activities. Final disposition of these funds remains subject to a formal Cosmos Hub governance vote. The Neutron recovery team is expected to submit a proposal in the coming week outlining the return process. Meanwhile, administrators have alerted over 30 exchanges and custodians to blacklist the attacker’s addresses to prevent further off-ramping of the remaining stolen assets.