Cosmos Hub stakers are rejecting the proposal, and most of them are using the strongest vote Cosmos governance offers. Around 95% of the ATOM voted so far says no. As of 2:34 p.m. ET on Friday, roughly 69.3 million ATOM had been cast on proposal 1056, and about 95% of it was No with Veto. Yes votes came to only about 174,300 ATOM.
The proposal would have the Cosmos Hub return the ATOM that validators took from the address behind the Neutron attack. It also promises a payout to anyone who votes in favor.
A refund demand that pays its supporters
The proposal was posted at 7:20 p.m. ET on Wednesday. On-chain it is called “ATOM Refund & Justice Bounty,” and it makes its claim bluntly: “Cosmos Hub reps coordinated validators to unjustifiably steal 1.2M ATOM” from the attacker’s address. It asks for 1,221,120 ATOM to be handed back.
It also offers voters a reward. Everyone who votes yes would share a 500,000 ATOM “Justice Bounty,” split by staking weight. The bounty would be paid over six months, and no single voter could receive more than 5,000 ATOM.
The message attached to the proposal is stranger still. It would move 1,721,120 ATOM from the Hub’s community pool to the address that filed the proposal, which is not the address the Hub swept. That means the funds would not even go back to where they were taken from.
How the ATOM ended up in a multisig
The coins come from the Neutron incident. A Neutron governance vote closed on the night of Sept. 21 and gave the attacker admin control over contracts run by Astroport and Drop. Validators stopped the chain and then restarted it. When it came back online on Wednesday, the 1,227,121 ATOM still sitting in the address had been moved into a 4-of-6 multisig.
Six Hub validators hold the keys: Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. The funds cannot move unless at least four of them sign.
The Hub team rejected any suggestion that its own chain had a flaw. In Thursday’s weekly update, it said “there was no vulnerability on the Cosmos Hub” and that the patched software “touched exactly one account.”
The attacker was still moving money
The seizure didn’t catch all of the funds. At 8:07 a.m. ET on Wednesday, minutes after the restart, 168,990.9 ATOM came back to the attacker’s address from THORChain.
That money came from a swap that went wrong. On Sept. 22, the attacker put 200,000 ATOM into a THORChain swap for ether. THORChain’s records show that about 19.9 ETH went out before the swap hit its price limit, and the remainder was refunded. By 1:54 p.m. ET on Wednesday, the attacker had sent 168,990 ATOM over IBC to an Osmosis address.
Low turnout could sink it first
Voting closes on Sept. 30, and the veto may never matter. If turnout stays below 40% of staked ATOM, the proposal fails anyway. On Friday afternoon, turnout was about 21%.
If turnout does pass 40% and No with Veto stays above 33.4% of the vote, the proposal fails and its 500 ATOM deposit is burned. On current numbers, whoever filed it would lose 500 ATOM for asking the community pool to pay them 1,721,120.