Tuesday, September 22, 2026

Astroport

Funds lost

$50K

Attack type

Access Control

Category

Exchange (DEX)

Summary

On September 22, 2026, Cosmos ecosystem DEX Astroport suffered a security breach on the Neutron chain that exposed protocol admin controls. Validators halted Neutron and Cosmos Hub to coordinate an emergency response, intercepting approximately 1.396 million ATOM (~$2.53 million USD) before the attacker could cash out.

Details of the Exploit

The attacker compromised admin privileges for Astroport contracts on Neutron, placing liquidity across connected pools at risk. The attacker converted stolen funds into ATOM and initiated a streaming swap of 200,000 ATOM to ETH via THORChain. Only 15.5% of the swap filled (19.92 ETH) before Cosmos Hub halted at block 33,086,740.

Cosmos Hub validators deployed a binary upgrade that transferred 1,227,121 ATOM from the attacker's account to a recovery multisig and added an ante-handler to block the attacker's key from signing future transactions. An additional 168,990 ATOM refund remains queued on THORChain, requiring a secondary sweep once GAIA chain processing unhalts. Astroport contracts on Terra were unaffected after their admin connection to Neutron was severed.

Source: De.Fi REKT Database. Data as of November 9, 2026.