Cosmos Hub resumed block production after validators halted the network for nearly 25 hours in response to a governance attack that began on Neutron. In the first committed block after the restart, 1,227,121 ATOM, valued at about $2.1 million at the time of reporting, moved out of the wallet holding reported attack proceeds. Unchained, TokenPost.
Unchained reported that the transfer appeared in block events without a transaction signed by the wallet owner. The tokens went to a newly created address. Cosmos Hub's public statement said validators were preparing an update intended to address the stolen ATOM, but the cited statements did not identify who controlled the receiving address.
Those details support two conclusions: the Hub restarted, and the tokens moved. They do not by themselves establish a completed recovery, a final allocation of the assets or the legal basis for the intervention. Neutron remained halted at the time of the report, while projects affected by the governance attack continued issuing separate instructions to users.
For operators and users, the incident raises questions beyond the immediate balance movement. A post-incident account should explain why the Hub was halted, which consensus or software changes authorized the transfer, how the destination is controlled and what conditions must be met before the funds move again. Until those points are documented, wallet and bridge decisions should rely on current project notices rather than assumptions based on the Hub restart alone.