About 95% of the ATOM cast so far says no, and says it in the harshest way Cosmos governance allows. By 2:34 p.m. ET on Friday, No with Veto votes made up roughly 95% of the about 69.3 million ATOM cast on proposal 1056. Only about 174,300 ATOM had voted yes.
The proposal asks the Cosmos Hub to give back the ATOM that validators seized from the address behind the Neutron attack. It also offers to pay the people who vote for it.
A refund request with a bounty attached
On-chain, proposal 1056 is titled “ATOM Refund & Justice Bounty.” It went up at 7:20 p.m. ET on Wednesday, and its text doesn’t hedge. It says “Cosmos Hub reps coordinated validators to unjustifiably steal 1.2M ATOM” from the attacker’s address and asks for 1,221,120 ATOM to be returned.
Then comes the sweetener. Yes voters would split a 500,000 ATOM “Justice Bounty” according to staking weight. It would be paid out over six months, with a cap of 5,000 ATOM per voter.
The message attached to the proposal is where it gets stranger. It would move 1,721,120 ATOM out of the Hub’s community pool to the address that submitted the proposal. That isn’t the address the Hub swept. So the funds wouldn’t even go back where they came from.
How the ATOM ended up in a multisig
The coins trace back to Neutron. A governance vote there closed on the night of Sept. 21 and handed the attacker admin control of contracts run by Astroport and Drop. Validators halted the chain and restarted it. When it came back on Wednesday, the address’s remaining 1,227,121 ATOM had been moved into a 4-of-6 multisig.
Six Hub validators hold the keys: Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu. Any four of them have to sign off before the funds can move.
The Hub team pushed back on the idea that anything on its own chain broke. In its weekly update Thursday, the team said “there was no vulnerability on the Cosmos Hub” and that the patched software “touched exactly one account.”
The attacker was still moving money
The seizure didn’t catch everything. At 8:07 a.m. ET on Wednesday, minutes after the restart, the attacker’s address got 168,990.9 ATOM back from THORChain.
That money came from a swap gone sideways. On Sept. 22, the attacker put 200,000 ATOM into a THORChain swap for ether. THORChain’s records show about 19.9 ETH went out before the swap hit its price limit, and the rest was refunded. By 1:54 p.m. ET on Wednesday, the attacker had sent 168,990 ATOM over IBC to an Osmosis address.
Turnout is the other way this dies
Voting closes on Sept. 30, and the veto might not even come into play. The proposal fails if turnout stays below 40% of staked ATOM. On Friday afternoon, it stood at about 21%.
If turnout does clear 40% and No with Veto stays above 33.4% of the vote, the proposal fails and its 500 ATOM deposit gets burned. At current numbers, that means whoever filed it would lose 500 ATOM for asking the community pool to pay them 1,721,120.
