Move the 1,227,121 ATOM recovered after the Neutron exploit to the Neutron recovery multisig

Original Proposal Text

# Move the 1,227,121 ATOM recovered after the Neutron exploit to the Neutron recovery multisig This is a text proposal. It executes no messages, spends nothing from the community pool and changes no Hub parameter. If it passes, the Cosmos Hub authorizes the signers of the Hub recovery multisig, `cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64`, to send its full ATOM balance, less network fees, over IBC to the Neutron recovery multisig, `neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy`. A subsequent Neutron governance proposal will then return all recovered funds, including this ATOM, to the original Neutron contracts they were taken from. ## Background On 22 September 2026 an attacker passed Neutron governance proposal 9 with stake bought for about 20,199 USDC. The proposal handed 11 Neutron contracts to the attacker, who replaced their code, emptied them and bridged the proceeds to other chains. All 1,723,180.290498 ATOM taken went to the attacker's Hub address, `cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4n`. It came from three Neutron contracts, where it was held for Drop and Astroport users: - Drop dATOM to ATOM converter: 1,589,711.919394 ATOM - Drop withdrawal manager: 115,878.183542 ATOM - Astroport ATOM/dATOM pool: 17,590.187562 ATOM Hub validators halted the chain at block 33,086,740. On 23 September the Hub restarted on Gaia v28.3.0 with a one-time state change at height 33,086,741 that moved the 1,227,121.374688 ATOM still on the attacker's address to a 4-of-6 recovery multisig. No other account, balance or delegation was touched. The signers are Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. They agreed to move the funds only after a passed Cosmos Hub governance proposal gives them a mandate. This proposal is that mandate. ## Mandate If this proposal passes, the signers of `cosmos1z8pq5cn7tdrwwzlwm0e44fgq07e43ner6vph64` are authorized to: 1. Send the multisig's full `uatom` balance, less network fees, to `neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy`. 2. Use a standard ICS-20 `MsgTransfer` from the Hub over `channel-569` (Neutron `channel-1`), with an empty memo and a timeout long enough to cover a relayer outage. On Neutron the ATOM arrives as `ibc/C4CFF46FD6DE35CA4CF4CE031E643C8FDC9BA4B99AE598E9B0ED98FE3A2319F9`. 3. Send a small test transfer first, for example 1 ATOM, and send the rest only after it has arrived. 4. Split the transfer only if a technical limit prevents a single transfer. No ATOM may be held back. 5. Publish the hashes of every transfer and its IBC acknowledgement, and the final balances of both multisigs, in the forum thread. The signers may not send the ATOM to any other address. A different destination requires a new Hub proposal. ## Why the ATOM goes to Neutron - It was taken from Drop and Astroport contracts on Neutron and belongs to their users. - The Hub was not exploited. It only received the stolen funds. Its validators, users and community pool lost nothing, and nothing here asks the Hub to pay for anything. - The Neutron recovery multisig already holds everything recovered on Neutron: 1,671,302 USDC, 95.2 million NTRN, 370.3 million ASTRO, the stolen dATOM, 14.09 axlWETH and smaller balances. Its signers are 01node, Stake&Relax, Polkachu, Newt Node and Solva. With the ATOM there as well, a single Neutron proposal can return everything. - The contracts and the affected positions are on Neutron, so Neutron governance is the right place to approve how the funds go back. ## Next step on Neutron After the ATOM arrives, a Neutron governance proposal will be submitted to return all recovered funds, the ATOM included, to the original contracts they were taken from. Those contracts have been back on their original code and admins since Neutron's recovery release on 25 September, so users can then withdraw through the original Drop and Astroport interfaces. The Neutron multisig signers follow the same rule as the Hub signers: no transfer without a passed Neutron governance proposal. Until then the ATOM stays in the Neutron recovery multisig. ## What this proposal does not do - It does not spend from the community pool or change any Hub parameter or module. - It does not execute an on-chain message. The signers send the transfer with their own keys. - It does not decide how the funds are returned on Neutron. Neutron governance decides that. - It does not cover ATOM that was not recovered, including the roughly 496,000 ATOM sold before the halt and the 168,990 ATOM THORChain refund that reached the attacker after the restart. - It does not change the multisig's signers or threshold. ## Vote options - Yes: move the recovered ATOM to the Neutron recovery multisig as described. - No: keep the ATOM in the Hub recovery multisig until a different proposal passes. - No with veto: reject the proposal as spam or as a violation of the Hub's values, and burn the deposit. - Abstain: count toward quorum without taking a side. ## Links - Forum discussion: https://forum.cosmos.network/t/discussion-move-the-1-227-121-atom-recovered-after-the-neutron-exploit-to-the-neutron-recovery-multisig - Neutron incident post-mortem: https://x.com/i/status/2104924316357841306 - Hub halt, restart and recovery multisig: https://forum.cosmos.network/t/hub-weekly-update-17-september-24-2026/17364