Neutron Governance Vote Hands Contract Admin Keys to One Address, Cosmos Hub Halts

A governance proposal on Neutron passed on September 22 and moved admin control of several smart contracts to a single address. Later that day, Cosmos Hub said its validators had halted the network to limit ATOM losses tied to the exploit.

What the Proposal Did

The chain's own governance record lists Proposal 9, titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration." It ran on the expedited track. Voting opened on September 19 and closed on September 22 at 02:24 UTC, and it passed.

The proposal contains 11 messages. Every one is a MsgUpdateAdmin call, and each names the same new admin: the address that submitted the proposal. A contract admin can normally swap in new contract code, so that role controls what the contract does with funds.

The proposal text describes a research experiment on AI agents and says it would run on a testnet. The messages, though, ran through the live Neutron chain.

The Vote

The final tally shows about 37.3 million NTRN voting yes. About 8.1 million voted no, and about 170,000 voted no with veto. That is roughly 82 percent yes among those three options.

The proposal carried a deposit of 1 million NTRN. We did not trace who held the voting wallets, so we make no claim about who was behind them.

The Losses and the Halt

DefiLlama's hacks database lists two Neutron incidents dated September 22 with the technique tagged "Malicious Proposal." It shows Astroport at $4.9 million and Drop at $4.4 million, about $9.3 million combined.

Cosmos Hub posted that its validators "temporarily halted the network to mitigate ATOM losses from a governance exploit." It stressed that the Hub itself is not affected. The community, it said, was identifying and isolating wallets with impacted funds before resuming operations.

The post quotes an earlier statement from Spaydh, who wrote that an attack hit Astroport on Neutron and the chain was halted to prevent further harm. The community is leading an investigation, the statement adds.

Cosmos Hub on X posted the halt notice on September 22 at 2:31 PM.

Why It Matters

On the record, the chain's own governance carried out the change. That makes the risk different from a typical code exploit, because a passed vote is all it takes.

Expedited proposals shorten the window for others to react. Here the window was three days, from September 19 to September 22. Projects that hold contract admin rights under chain governance now have a concrete case to study.

For users, the practical lesson is to check who holds admin rights over the contracts they use, and whether a governance vote can change that.

The halt also shows a link between a smaller chain and the Hub. A problem on Neutron led Cosmos Hub validators to stop their own network. That is a costly step, and the post gives no timeline for a restart.

What We Could Not Confirm

Other outlets have published larger totals, attacker identities and recovery figures. We have not been able to trace those to a primary source, so we left them out. This story is still developing.

This article is for information only and is not investment advice. Token prices move quickly.