Neutron DAO governance proposal handed contract admin to an attacker (Astroport, Drop)

What happened

• 22 Sep 2026: Neutron DAO proposal #9 (“AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration”) passed with 11 “Update Admin” actions. SlowMist recorded losses the same day of about USD 4.9M at Astroport and USD 4.4M at Drop (about USD 9.3M total). Astroport warned the attack “may have led to the theft of administrator privileges” for its contracts.
• Root cause: a malicious governance proposal, not a key compromise. One outlet reports about USD 20K in NTRN was spent to pass it.
• Attribution: none.
• Response: Neutron halted the chain. Cosmos Hub validators halted for about 24 to 25 hours and on restart moved about 1.23M ATOM from the exploiter’s wallet. Final unrecovered loss is unclear.

Sources

• https://cryptoslate.com/neutron-dao-passes-a-new-proposal-and-9-3m-in-crypto-disappears/
• https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/
• https://cryptobriefing.com/cosmos-hub-restarts-25-hour-halt-stolen-tokens/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.