Governance security has a price, and on Neutron that price turned out to be $20,199.
That is what an attacker spent on 31.62 million NTRN eleven minutes before a vote tally closed on September 22, according to a breakdown by security firm GoPlus Security reported by Cryptonomist. The purchase bought decisive voting power over a governance system that held administrative control of contracts run by the decentralized exchange Astroport and by DropDotMoney. Roughly $9.4 million left those contracts once the proposal executed. Nothing in the chain was broken to make that happen: the proposal passed, and the permissions it granted worked exactly as documented.
Key Takeaways
- On September 22, an attacker used a Neutron governance proposal to seize admin rights over Astroport and DropDotMoney contracts and drained about $9.4 million, of which roughly $1.96 million had already been bridged out.
- The attacker voted early with about 100 NTRN, then bought 31.62 million NTRN for $20,199 in USDC just 11 minutes before the tally and delegated it to swing the result.
- Neutron runs on wasmd, which lets chain-level governance execute MsgUpdateAdmin and reassign a contract’s administrator, overriding the app-level multisigs Astroport and DropDotMoney relied on.
- The staked NTRN securing that vote was worth about $113,000 at the time, while the governance it backed controlled roughly $9.4 million in contract assets.
- Within 24 minutes of execution, 10 contracts were migrated to attacker-supplied code and emptied, with funds spread across Neutron, Cosmos Hub, Noble, Axelar, dYdX, Osmosis and Ethereum addresses.
The payload arrived dressed as AI research
The attack vehicle was Proposal #9, titled “AIATO: AI Agent Takeover,” which presented itself as an AI governance research experiment. Underneath that framing sat 11 MsgUpdateAdmin messages, each one designed to reassign control of a contract.
GoPlus Security says the proposal moved on an expedited track: a three-day vote, a 67% approval threshold and a 1 million NTRN deposit requirement. A high threshold on paper reads like a safeguard. In practice it only raises the bar in proportion to the cost of the tokens needed to clear it.
The attacker treated the vote as a two-stage operation. An early ballot cast with roughly 100 NTRN established a position without drawing attention. The decisive move came 11 minutes before the tally closed, when 31.62 million NTRN bought with $20,199 in USDC was delegated in one go.
An hour before voting ended, the attacker uploaded new contract code as code_id 5399, containing a withdraw_all function that sends a contract’s balance to a chosen recipient. The destination code was therefore already on-chain and waiting before anyone knew how the vote would land.
Chain governance outranked the multisigs
The structural problem sits in wasmd, the framework Neutron runs on. Chain-level governance can execute MsgUpdateAdmin, the message that rewrites a contract’s designated administrator. That authority sits above whatever the application developers configured for themselves.
Astroport and DropDotMoney both guarded their contracts with multisig wallets, which is standard practice and which most users would reasonably treat as the last line of defence. It was not. As TokenPost frames the same finding, chain-level governance could override application-level multisig protections, which is how $20,000 of voting power ended up controlling contracts worth millions.
Execution was mechanical once the proposal passed. Within 24 minutes the attacker issued MsgMigrateContract calls moving 10 contracts to code_id 5399, then called withdraw_all on each in turn.
The numbers that made it worth trying
The clearest figure in the GoPlus breakdown is the mismatch between what secured the vote and what the vote controlled. At prices when the attack occurred, the staked NTRN behind that governance was worth about $113,000. The contracts under its authority held close to $9.4 million.
That ratio is the actual vulnerability, and it is not specific to Neutron. Any system where a token-weighted vote can rewrite contract permissions inherits the same arithmetic: if the market cost of acquiring decisive voting power falls below the value sitting behind that vote, the incentive to buy the vote exists whether or not anyone acts on it. Here the gap was wide enough that a single spot purchase closed it.
The trail runs across the Cosmos ecosystem and Ethereum
GoPlus Security traced attacker-controlled addresses on Neutron, Cosmos Hub, Noble, Axelar, dYdX and Osmosis, all tied to the same private key, with Ethereum addresses also linked to the operation. That spread is the usual response to an on-chain theft, since moving value across bridges and networks fragments the tracing effort.
Of the roughly $9.4 million, about $1.96 million had already been bridged out when the breakdown was published, a figure worth reading as a snapshot rather than a final total. GoPlus Security reads the gap between the two as a sign that some of the assets may still be traceable.
The open question the incident leaves is a measurable one rather than a rhetorical one. For any governance-controlled protocol, two numbers can be pulled today: the market cost of acquiring enough stake to pass a proposal, and the value held in the contracts that proposal could reach. Neutron’s answer was about $113,000 against $9.4 million. Few chains publish the comparison, and after September 22 that silence is harder to justify.
