Cosmos Hub restarted after a nearly day-long halt, moving 1.23 million ATOM linked to a governance exploit on Neutron.

Validators resumed block production on Sept. 23 after stopping the network a day earlier, with the first block after the restart moving 1,227,121.37 ATOM , worth about $2.2 million, from an attacker-linked address.

The intervention followed the movement of funds stolen from Neutron onto Cosmos Hub, extending the fallout from an attack that began on a separate blockchain in the Cosmos ecosystem . Cosmos Hub said its network was not exploited and that the halt was intended to secure assets bridged from Neutron before they could move further.

Block production resumed at block 33,086,741, with the upgrade transferring the attacker-linked balance into a recovery address before ordinary activity continued. Cosmos Hub later said the secured assets had been placed in a community validator multisig while participants coordinated their return.

Former Neutron contributor Spaydh said the attack began after an attacker accumulated enough NTRN voting power to pass an expedited governance proposal that reassigned administrative rights over 11 smart contracts.

The affected contracts included infrastructure used by Astroport, Drop, and other protocols and were subsequently migrated to malicious code that allowed assets to be withdrawn.

Spaydh estimated the initial impact at roughly $4.4 million, comprising about $3 million in ATOM, $1.2 million in USDC, around $100,000 in DYDX and smaller amounts of wstETH and WETH. Notably, CryptoSlate previously reported that the losses amounted to roughly $9.3 million .

Neutron’s rate limits and subsequent halt prevented some of those assets from leaving the network. Spaydh said more than $1.6 million in USDC was protected, along with significant amounts of NTRN and ASTRO.