Neutron DAO
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·53Ahjw…TNe2Summary
On September 22, 2026, an attacker used Neutron's on-chain governance system to seize administrative control of 10 smart contracts across the Astroport decentralized exchange and the Drop liquid staking protocol, draining an estimated $9.3–9.4 million within roughly 24 minutes of the malicious proposal's execution. The attacker spent only $20,199 to acquire enough NTRN tokens to pass the proposal, exploiting a structural gap between Neutron's low bonded governance stake and the much larger value secured by contracts governance could control, rather than a conventional smart-contract bug. The incident forced Cosmos Hub validators into an approximately 24-to-25-hour network halt — described as the first time a parent chain has halted because of a consumer-chain governance exploit — to intercept and freeze bridged funds, a portion of which has since been recovered to a validator multisig pending a governance-approved return process.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
September 2026
A governance proposal titled 'AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration' (Proposal 9) is filed on Neutron's expedited governance track, containing 11 MsgUpdateAdmin messages naming the proposer's address as administrator of Astroport and Drop contracts.
CryptoSlate / Cryptonomist22 September 2026
Proposal 9 passes with approximately 81.88% approval after the attacker purchases 31.6 million NTRN tokens roughly 11-12 minutes before the vote closes, having spent $20,199 to do so.
CryptonomistSeptember 2026
The attacker uses admin control to migrate 10 Astroport and Drop contracts to malicious bytecode and drains them within approximately 24 minutes, for an estimated $9.3-9.4 million in combined losses.
CryptoSlate / GoPlus SecuritySeptember 2026
Cosmos Hub validators halt the network at block height 33,086,740, roughly 11:00-11:18 UTC, to prevent further outflow of stolen funds bridged from Neutron.
Cosmos Forum recovery updateSeptember 2026
Cosmos Hub resumes block production after roughly 24.5 hours, having applied a patched binary and transferred 1,227,121.37 ATOM from attacker-linked addresses to a 4-of-6 validator multisig.
Cosmos Forum recovery updateSeptember 2026
Cosmos Hub Proposal 1056, an 'ATOM Refund & Justice Bounty' proposal seeking to return the seized 1.2 million ATOM to the attacker's wallet with a bounty for supporting voters, is submitted and rejected with roughly 94.64-95% of votes cast as 'NoWithVeto'.
CryptoBriefing / UnchainedDecision Log
- hash: Fw4QFNp4tybzksR9GVKCqT2RHv9bjFHnDotHXSUfmeZf
This investigation is cryptographically anchored to the Solana blockchain (1 event). 6 of 8 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 10/6/2026, 8:04:27 PM
last updated: 10/6/2026, 10:01:51 PM
avoid.net — verified advice for a post-truth world