A security operation designed to recover stolen funds on Cosmos Hub appears to have missed one key detail: some of the money had not arrived yet.
According to an on-chain investigation, Cosmos Hub successfully recovered about 1.2 million ATOM from an attacker-controlled address during a network upgrade. However, another 168,990 ATOM was still being refunded from THORChain.
The refund arrived only after the recovery operation had finished, allowing the funds to return to the attacker’s wallet.
The attacker later moved the assets across several networks and converted part of them into ETH and USDC.
The incident highlights a major challenge in multichain security: recovering the funds already sitting in a wallet may not be enough if other assets are still in transit.
Cosmos Hub Recovered 1.2 Million ATOM but Missed Another 168,990
The incident is connected to the earlier Neutron and Astroport exploit.
As part of the recovery effort, Cosmos Hub carried out a network upgrade that transferred about 1.2 million ATOM from the attacker’s address to a secure wallet.
But another 168,990 ATOM was still on its way back from THORChain.
Cosmos Hub completed the recovery at block height 33,086,741, while the THORChain refund arrived seven blocks later.
In simple terms, the attacker’s wallet was emptied before the refund arrived.
Once the new funds entered the wallet, they were no longer covered by the original recovery operation.
The Attacker Waited Nearly Six Hours Before Moving the Funds
The attacker did not move the newly arrived ATOM immediately.
The funds remained in the wallet for about 5 hours and 47 minutes before major transfers began.
The attacker first sent 50,000 ATOM to a new address.
Around 30,000 ATOM later moved through several chains:
Osmosis → Cosmos Hub → Terra → Cosmos Hub → Osmosis
The funds eventually returned to Osmosis, where they were reportedly sold.
The attacker also used Axelar to transfer 78,010 USDC to an Ethereum wallet:
0x9bfcca13b4ac907433ac68766e96309ac867f819
At the time of the investigation, the wallet still held about 29.22 ETH.
The movement from Cosmos Hub to Ethereum took roughly 53 minutes.
The investigation also reported transactions involving around 100 ETH, although the exact proceeds still require further verification.
Why Did the Security Measures Fail?
The incident appears to expose two main weaknesses.
First, the recovery operation only covered funds already present in the attacker’s wallet at a specific block height.
It did not account for delayed cross-chain refunds or transactions that were still in progress.
That is why the 168,990 ATOM from THORChain arrived too late to be included.
Second, THORChain had reportedly stopped monitoring Cosmos Hub but had not stopped signing outbound transactions to it.
According to the investigator:
HALTGAIACHAIN = 1meant monitoring of Cosmos Hub was halted.HALTSIGNINGGAIA = 0meant outbound transactions could still be signed.
As a result, once Cosmos Hub restarted, the pending refund could still be processed and sent to the attacker’s address.
Why Was the Attacker Still Able to Transfer Funds?
Another unresolved issue is why the attacker was able to move the funds at all.
The address was reportedly supposed to be restricted.
Normally, transactions should pass security checks before execution. If they fail, they should never reach the stage where assets are transferred.
However, on-chain records reportedly show that the attacker’s transaction reached the bank module and successfully paid a transaction fee.
That suggests the restriction did not block this particular IBC transfer.
The exact reason remains unclear. The investigator said the relevant v28.3.0 source code was unavailable for review, making it difficult to determine why the transaction was allowed.
Where Did the Funds Go?
After leaving Cosmos Hub, parts of the funds moved through Osmosis, Terra, Axelar and Ethereum.
At the time of the investigation, three Ethereum wallets were identified with the following balances:
- Wallet 1:
0xEF6c...a5D54— approximately 671 ETH - Wallet 2:
0xe149...1fBA5c— approximately 94.43 ETH - Wallet 3:
0x9bfc...7f819— approximately 29.22 ETH
These balances should not be treated as the total losses from this incident, and they do not prove that all funds in those wallets came from the delayed 168,990 ATOM refund.
Investigators also identified several new addresses across Osmosis, Cosmos Hub and Terra.
As funds move across more networks and wallets, tracing and recovering them becomes increasingly difficult.
Why This Matters
The incident shows that a network upgrade does not necessarily mean a security breach has been fully contained.
In a multichain ecosystem, funds may still be moving through bridges, refunds or pending cross-chain transactions after emergency measures are completed.
For security teams, recovery plans therefore need to consider not only the money already inside an attacker’s wallet, but also assets that may arrive later.
The case also shows the importance of coordinating monitoring, transaction signing and wallet restrictions across different networks.
For ordinary crypto users, the lesson is simple: even when an attacker’s address has been identified, cross-chain timing and security gaps can still create opportunities for funds to escape.
Can the Funds Still Be Recovered?
That remains uncertain.
The funds have already moved through several networks, including Cosmos Hub, Osmosis, Terra and Ethereum, while some ATOM was reportedly converted into ETH and USDC.
The additional 168,990 ATOM escaped because the refund arrived after the original recovery operation had finished, and later transaction restrictions failed to stop the attacker from moving the funds.
Whether the remaining assets can eventually be tracked, frozen or recovered will depend on where they move next and whether exchanges or other service providers can intervene.
The broader lesson is clear: in a multichain security incident, asset recovery must account for the full movement of funds across networks, including transactions that have not yet been completed.