Cosmos Hub restarted on Sept. 23 after validators halted block production for nearly a day to secure ATOM moved from Neutron following a governance exploit. The first block after the restart transferred 1,227,121.37 ATOM, worth about $2.2 million, from an attacker-linked address to a recovery address, and the funds are now held in a community validator multisig. A later THORChain refund of 168,990.9 ATOM reached the same address after the sweep, however, and was transferred to Osmosis and sold for about 266,841 USDC before much of the proceeds were converted into Ethereum. The attack began when an attacker obtained sufficient NTRN voting power to approve Proposal #9, changing administrative rights for 11 contracts used by Astroport, Drop and other protocols. Reported losses and exposure estimates vary: SlowMist put Astroport and Drop impacts at $9.3 million combined, while a newer account estimated initial stolen assets at about $4.4 million and said Neutron rate limits and its halt protected more than $1.6 million in USDC and significant NTRN and ASTRO holdings. Neutron contributors have prepared software to restore affected contracts and administrators, strengthen governance controls and transfer remaining attacker-controlled assets to a validator multisig before restarting the chain.