Cosmos Hub gets 1.23 million ATOM after Neutron attack

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

Cosmos Hub 验证者通过暂停网络成功追回 Neutron 治理攻击中的 123 万 ATOM

Cosmos Hub 的验证者在将网络暂停约 24.5 小时并将代币转移至恢复钱包后，成功锁定了 123 万枚 ATOM。此次行动旨在遏制 Neutron 治理攻击造成的进一步损失。

事件概要

约有 173 万枚被盗的 ATOM 从 Neutron 流入 Cosmos Hub。随后，验证者将 1,227,121 枚 ATOM 转移到一个需要六名签名者中的四人批准才能执行交易的钱包中。在网络重启后，另有 168,990.9 枚 ATOM 到达攻击者手中，并被转移至 Osmosis 进行出售。

要归还这些被锁定的资金，必须经过 Cosmos Hub 的治理投票。Cosmos Labs 在 9 月 25 日的更新中指出，Hub 本身并未受到攻击，Hub 用户资金未受影响。被盗的 ATOM 来自 Neutron，在该链上，一项恶意的治理提案使攻击者控制了 Astroport 及其他协议所使用的合约。

技术干预与网络恢复

在 Hub 暂停时，仍有 1,227,121 枚 ATOM 停留在攻击者的地址中。验证者于 9 月 23 日使用 Gaia v28.3.0 软件更新重启了网络，该更新将余额转移到了由六位社区验证者控制的钱包中。任何从该钱包发起的交易都必须获得其中四人的批准。

目前这些代币处于保管状态，等待 Neutron 恢复团队制定计划。根据 Cosmos Labs 描述的安排，在 Cosmos Hub 治理提案授权转账之前，签名者无法返还资金。

在 9 月 22 日 Neutron 遭受攻击后，攻击者将被盗资产发送到了多个区块链，并开始通过 THORChain 兑换部分 ATOM。据 Cosmos Labs 账号披露，约 173 万枚 ATOM 抵达 Hub，即便 Neutron 停止出块，攻击者本可在 Hub 上继续转移这些资产。

Neutron 的贡献者和社区成员在 UTC 时间约 09:50 向 Hub 验证者和 Cosmos Labs 发出警报。代表超过 Hub 三分之一投票权的验证者随即停止其节点，导致网络在 UTC 时间约 11:18 于区块高度 33,086,740 处暂停。

在暂停期间，应验证者要求，Cosmos Labs 准备了一次性的软件变更。其书面计划明确了攻击者地址、目标钱包、拟议的六位签名者以及受此更新影响的单个账户。验证者在分发补丁软件前已收到该计划。

Nansen、Keplr、Enigma、Silknodes、Kiln 和 Polkachu 同意持有这六个签名密钥。Cosmos Labs 表示，在开发者将其添加到更新之前，签名者独立检查了钱包地址，并通过测试交易进行了验证。

By the scheduled restart time, verifiers representing more than two-thirds of the voting rights had installed v28.3.0. Block production resumed at 12:00 UTC on September 23, and the transfer of 1,227,121.37 ATOM took effect approximately six minutes later. Cosmos Labs said that as of the end of the day, 174 of the Hub's 180 validators were online.

Verifiers involved in this operation include Coinbase and Kraken. Their role was part of Hub coordinating software restarts;Cosmos Labs said exchanges and other operators were then told to resume deposit and withdrawal services once the network stabilized.

Some ATOM have lost before and after the restart.

The locked balance only represents the ATOM that was still in the attacker's Hub address when the verifier suspended the chain. Cosmos Labs pointed out that before the suspension, approximately 500,000 ATOM pieces had been exchanged for ETH through ThorChain and could not be recovered through Hub updates.

Another independent THORChain transaction returned 168,990.9 ATOM to the attacker's address shortly after the network was restored. According to forum posts, the attacker transferred the balance to Osmosis and sold it.

Cosmos Labs said it discovered the possible refund opportunity when the verifier was preparing to restart, after the patch software had been distributed to many carriers and installed. The update only authorizes one transfer of the balance that existed at the time of the suspension, and it does not prevent subsequent transfers at the attacker's address, nor does it move funds that arrive after the restart.

Hub 的响应措施也不涵盖发送到其他网络的资产。Cosmos Labs 确定了已流经 dYdX、Noble、Osmosis、Axelar 和 EVM 链系的被盗资金，以及仍留在 Neutron 上的资产。处理这些网络的团队正在协调各自的恢复工作。

此前曾发生另一起独立事件，影响了其他 Cosmos 网络使用的软件。今年 8 月，有报道指出攻击者利用 Cosmos EVM 的漏洞跨六条链作案，并将被盗代币转换为约 572 万美元的其他资产。Cosmos Labs 对 Neutron 事件的描述属于 Neutron 的治理攻击，而非前述的 Cosmos EVM 漏洞。