What happened
On September 22, 2026, an attacker used Neutron's on-chain governance to take admin control of Astroport and Drop contracts and drain them. SlowMist estimated about $4.9 million lost from Astroport and $4.4 million from Drop, roughly $9.3 million in total; GoPlus put it at $9.4 million. No smart-contract bug was needed.
Proposal #9, "AIATO: AI Agent Takeover", was pitched as an AI-governance experiment, but it contained admin-change messages that gave ten contracts to the proposer. The attacker bought 31.62 million NTRN for about $20,199 just 11 minutes before the vote closed, and two attacker-linked wallets cast about 98% of the YES votes. Once the proposal executed, the contracts were migrated to malicious code and drained within about 24 minutes.
The attacker moved funds out over IBC and THORChain. Cosmos Hub validators halted the Hub for about 25 hours and moved 1,227,121 stolen ATOM (covering both protocols) out of the attacker's wallet to a multisig. About 500,000 ATOM swapped to ETH through THORChain was not recovered.
How it happened
- The attacker submitted Neutron Proposal #9 on the expedited three-day track. It contained 11
MsgUpdateAdminactions that would make the proposer's address the admin of ten Astroport and Drop contracts. - About an hour before voting closed, the attacker uploaded
code_id5399, which contains awithdraw_allfunction. - Eleven minutes before the tally, the attacker bought 31.62 million NTRN for about $20,199 USDC and used it to vote, so the proposal passed.
- Neutron's
wasmdlets chain governance change a contract's admin directly, which skipped the multisig protections set up at the app level. - As the new admin, the attacker used
MsgMigrateContractto switch the contracts to code 5399 and drained them within about 24 minutes. Funds were then bridged out through IBC and THORChain.
Protocol details
Security review history
- Halborn View report
- Oak Security View report
Evidence
- report @astroport_fi incident report x.com
- report @Rarma_ incident report x.com
- code [NEW]: Neutron governance takeover drains ~$9.4M from Astroport and Drop (web3-is-going-great issue #1306) github.com
- code [DEEP DIVE] Neutron Governance Exploit Drains $9.4M in 24 Minutes github.com
- analysis DeFiLlama defillama.com
- analysis Neutron DAO passes a new proposal, and $9.3M in crypto disappears cryptoslate.com
- analysis Neutron Governance Attack Exposes $9.4M Blockchain Exploit en.cryptonomist.ch
- analysis Neutron Governance Attack: Cosmos Hub Response and Recovery Update forum.cosmos.network
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
