Neutron: The $9.3M Takeover That Lost a Vote, Then Won One

In August, the owners of Neutron were asked a simple question: should one anonymous address be given the master keys to ten of the network's most important money-holding programs? They said no, by 10.4 million votes to 320,000. On 22 September 2026 the same address asked again. This time the answer was yes, and within 40 minutes the programs had been emptied.

Neutron is a blockchain, a shared financial ledger kept by a network of independent computers, and it is home to Astroport, an automated exchange that began life on Terra, and Drop, a service built by Hadron Labs that stakes customers' ATOM, the token of the neighbouring Cosmos Hub network, and hands back a tradable receipt, like a certificate of deposit. The security firm SlowMist put the losses at $4.9 million from Astroport and $4.4 million from Drop, about $9.3 million in all. GoPlus Security, another monitoring firm, counted $9.4 million. The votes that decided it cost $20,199.

Nothing was hacked in the usual sense. No password was stolen and no code was broken. The attacker won an election.

How a vote could hand over the keys

Neutron is run a little like a listed company. Its token, NTRN, works like a share. Holders who lock their tokens up, a process called staking, get a vote on proposals, much as shareholders vote at an annual meeting. The difference is that a Neutron vote does not ask a board to act. When a proposal passes, the network carries out its instructions automatically.

The apps on Neutron are smart contracts: programs that hold money and move it by themselves, according to their code. Each has an "admin", the account allowed to swap the code for a new version. Astroport and Drop held the admin rights to their own contracts. But Neutron's governance system sits above every app on the network. A passed vote can reassign any contract's admin, whatever the app's own team thinks. GoPlus Security called it the root cause: the apps' own controls "were not the final authority".

In shareholder terms, the company's constitution let any sufficiently large shareholder vote to take the keys to the customer vaults. The only defence was that nobody would ever have enough votes.

That defence depended on the price of the shares. According to CoinGecko, NTRN was trading around 8 cents in September 2025 and $0.0003 on the eve of the vote, a fall of more than 99% in a year. At that price every NTRN in circulation was worth roughly $100,000 combined, while the contracts it governed held millions.

©CMZ chart. Data: CoinGecko

The rehearsal in August

The first attempt was filed on 24 August as proposal 5, "TestProp: Preparation for AIATO: AI Agent Takeover". Its text, still readable on Neutron's public records, described a research experiment in which artificial-intelligence agents would take "operational control of a live testnet", a practice network with no real money. It cited a genuine 2024 academic paper on governing AI agents, whose authors have no known connection to it, and credited funding to "PAMOLA CAPITAL", a name with no discoverable public footprint.

The attached instructions were not about research. They asked the network to make the proposer's own address the admin of ten contracts: six Astroport trading pools, Astroport's staking contract, Astroport's treasury and two Drop contracts. It was all public from 24 August. Voters rejected it on 31 August, and the deposit needed to file it, one million NTRN worth about $220, was handed back under Neutron's rules.

On 12 September the same address filed a second version. On 19 September it cancelled that one and, fourteen minutes later, filed proposal 9: "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration". Same text, same ten contracts, plus an eleventh: a Neutron contract holding locked-up tokens for the project's early investors. This time it used the expedited track, which shortens voting from seven days to three but requires a two-thirds majority.

©CMZ chart. Data: Neutron governance records

Eleven minutes

Without a late surge, the proposal was heading for defeat. The surge came at the last moment, and the timestamps are public.

At 01:18 UTC on 22 September, more than an hour before the vote closed, the attacker uploaded the malicious code it planned to install. A separate wallet then spent $20,199 in USDC, a digital dollar, almost all of it between 01:45 and 02:11, buying 31.62 million NTRN through Astroport's own trading pools. PublicAML, an on-chain tracing site, followed that wallet's money back to Secret Network, a privacy-focused blockchain. At 02:13 the wallet staked the lot. At 02:24 the vote closed.

The final count was 37.3 million NTRN for, 8.1 million against and 0.2 million for "No with veto", about 82% in favour. Take away the 31.62 million staked eleven minutes before the deadline and the proposal fails, with 5.7 million votes for and 8.3 million against. PublicAML also linked a second wallet, which supplied another 5.09 million yes votes, to the attacker through a payment of 1,000 USDC. Neutron's records show that payment arriving from the attacker's address at 05:19, two hours after the drain ended.

At 02:38 the attacker began using its new powers. One contract at a time, it replaced the code with its own, emptied the contract and moved to the next. The last one, the investors' vesting contract, was done by 03:04. The money was bridged out, the crypto equivalent of a wire transfer between banks: about 1.18 million USDC through the Noble network and Circle's transfer service to Ethereum, about 1.72 million ATOM to the Cosmos Hub, and smaller amounts to dYdX, Osmosis and Axelar.

The chain that stopped

Neutron's validators, the companies and individuals whose computers run the network, stopped it at 07:43 UTC, five hours after the vote. By then most of the money had left.

What happened next was unusual. Neutron's contributors alerted the Cosmos Hub, a separate blockchain, at about 09:53 UTC. Its validators could see a large share of the stolen ATOM sitting in one address, being fed through THORChain, a service that swaps tokens between blockchains. By 11:18 UTC enough of them had switched off their machines to halt the entire Hub.

Cosmos Labs, which maintains the Hub's software, known as Gaia, wrote a one-off patch: when the chain restarted, it would move everything in the attacker's address into a joint account that needs four of six named validators to sign, like a bank account requiring four of six directors. The signers were Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. Validators holding more than two-thirds of the network's voting power, including Coinbase and Kraken, installed it overnight.

The Hub restarted at 12:00 UTC on 23 September, after a halt Cosmos Labs put at about 24.5 hours. At 12:06 the patch moved 1,227,121 ATOM, worth about $2.2 million, out of the attacker's address. Some had already gone: about 500,000 ATOM had been swapped into ether through THORChain before the halt. Then, minutes after the restart, THORChain refunded a failed swap of 168,990.9 ATOM to the attacker's address. The patch had been written to act once, and the refund was sold on Osmosis, another exchange, for about 266,841 USDC.

©Cosmos Hub Forum

A blockchain sold as belonging to no one in particular had stopped for a day so its validators could take money out of one person's account. The stolen funds made that easy to defend. The precedent is harder to wave away.