Neutron Governance Takeover

On September 22, 2026, Neutron — the Cosmos DeFi appchain — suffered a governance takeover that drained approximately $9.4 million from the Astroport decentralized exchange and the Drop liquid-staking protocol. The attacker never exploited a code bug; they simply bought enough voting power to make the chain's own governance hand them the keys.

What happened

Eleven minutes before a governance vote tally, the attacker acquired about 31.6 million NTRN — for only around 20,199 USDC — giving them enough staked voting weight to pass a proposal. That proposal, number 9 and cynically titled "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration", rode the expedited three-day track and, once executed, transferred admin control over ten Astroport and Drop contracts to the proposer's address. Within 24 minutes of execution, all ten contracts were migrated to malicious code and emptied: roughly $4.9 million from Astroport and $4.4 million from Drop. Security firm GoPlus noted that the staked NTRN backing governance was worth only about $113,000 at the time, yet it controlled $9.4 million in assets — an 83:1 ratio that made the outcome economically inevitable.

Aftermath

Neutron and Cosmos Hub validators coordinated an emergency response, effectively halting the chain for about 24 hours to contain the damage and freeze what they could. Recovery efforts followed, with Cosmos Hub reporting that over 1.2 million ATOM tied to the attack path was secured, though a substantial portion of the drained value — roughly $2 million had already been bridged out — remained beyond reach. As of late September 2026 the stolen protocol funds were not returned, so the status here is stolen.

Why it matters

When the cost of acquiring a governance majority is a tiny fraction of the value that majority controls, the vote itself becomes the exploit. Expedited proposal tracks and low participation only widen the window. As with the BonkDAO governance takeover and the earlier Atlantis Loans malicious governance, the lesson is that on-chain governance needs economic guardrails — timelocks, quorum floors, and admin-migration delays — or an attacker will simply buy the outcome.