What happened
On September 22, 2026, Cosmos ecosystem DEX Astroport suffered a security breach on the Neutron chain that exposed protocol admin controls. Validators halted Neutron and Cosmos Hub to coordinate an emergency response, intercepting approximately 1.396 million ATOM (~$2.53 million USD) before the attacker could cash out.
The attacker compromised admin privileges for Astroport contracts on Neutron, placing liquidity across connected pools at risk. The attacker converted stolen funds into ATOM and initiated a streaming swap of 200,000 ATOM to ETH via THORChain. Only 15.5% of the swap filled (19.92 ETH) before Cosmos Hub halted at block 33,086,740.
Cosmos Hub validators deployed a binary upgrade that transferred 1,227,121 ATOM from the attacker's account to a recovery multisig and added an ante-handler to block the attacker's key from signing future transactions. An additional 168,990 ATOM refund remains queued on THORChain, requiring a secondary sweep once GAIA chain processing unhalts. Astroport contracts on Terra were unaffected after their admin connection to Neutron was severed.
Attacker Cosmos Address: cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
