Astroport has warned that an attack on the Neutron blockchain may have compromised administrator privileges for its smart contracts, prompting Neutron to halt the chain and Cosmos Hub validators to temporarily stop block production as the ecosystem investigates the incident.
Astroport urged users to withdraw liquidity from all of its liquidity pools as a precaution. The warning applies beyond Neutron because Astroport operates deployments across multiple Cosmos-based networks.
The incident began on September 22 and has raised concerns about whether compromised administrative access could be used to change contract settings or affect assets held in liquidity pools. However, the available information does not establish that all Astroport contracts or user funds were compromised.
Neutron Halts After Attack
Neutron suspended chain operations after detecting the attack and began investigating the incident. Astroport said the attack on Neutron may have resulted in the theft of administrator privileges for its contract.
The protocol then advised liquidity providers to withdraw their funds from Astroport pools across all supported chains.
The distinction between an administrative-key compromise and direct theft matters. Administrative privileges can allow authorized changes to smart-contract parameters or permissions, depending on how a contract is designed.
The available reports do not yet show that attackers used the suspected privileges to drain a specific amount of Astroport liquidity.
Neutron’s decision to halt the chain limits additional on-chain activity while developers and validators investigate what happened.
Cosmos Hub Also Temporarily Stops Block Production
The incident also affected the wider Cosmos ecosystem. Cosmos Hub validators temporarily halted block production on September 22 as the ecosystem responded to the security incident.
Cosmos Hub said the halt was a precaution and that the Cosmos Hub itself was not exploited. ATOM balances and delegations remained unaffected while the incident was investigated.
The halt temporarily prevented normal Cosmos Hub transactions from being processed while validators remained stopped. Staking activity was also affected during the pause.
The response shows that the incident extends beyond Astroport and Neutron, although the initial security concern remains focused on the possible compromise of Astroport’s contract administration privileges.
Astroport Urges Liquidity Providers to Withdraw Funds
Astroport’s warning covers its liquidity pools across supported networks rather than only pools deployed on Neutron.
The recommendation reflects uncertainty over the scope of the suspected administrative compromise. Astroport’s deployment structure means that a security issue affecting one chain or contract can require checks across other deployments.
Terra users received additional clarification from the Terra Phoenix Foundation. A later Astroport update said it administered its Terra contracts from Terra and that it had severed its connection to Neutron. The update said no Terra user funds were affected and that Neutron remained paused while a remediation plan was being developed.
This suggests the risk is not necessarily identical across every Astroport deployment.
| Detail | Current Status |
| Affected ecosystem | Neutron and Astroport |
| Reported issue | Possible compromise of Astroport contract admin privileges |
| Neutron response | Chain operations halted for investigation |
| Astroport response | Users urged to withdraw liquidity from all pools |
| Cosmos Hub response | Validators temporarily halted block production |
| Funds lost | No confirmed total disclosed |
Table 1. Current status of the Neutron and Astroport security incident.
The Incident Is Different From the Earlier Cosmos EVM Exploits
The latest incident should not be confused with the Cosmos EVM vulnerability exploited across several chains in August.
Cosmos Labs’ August post-mortem documented a separate vulnerability involving Cosmos EVM versions below 0.6.2 and 0.7.2. Attackers exploited balance-accounting flaws across six Cosmos-based networks, with approximately $2.87 million in affected assets bridged and sold through decentralized exchanges and another estimated $2.85 million deposited or sold through centralized exchanges.
The September incident instead centers on Neutron, Astroport, and a possible compromise of contract administration privileges. There is currently not enough evidence to connect the two incidents technically.
That distinction is important because both events involve Cosmos-based networks but appear to involve different attack mechanisms.
Why Admin Privileges Matter
Smart contracts often have administrative controls that allow designated accounts or multisignature wallets to perform certain privileged actions.
Depending on the contract, those permissions can include changing configuration, upgrading contracts, modifying authorized addresses, or managing other protocol functions.
A compromised administrator account can therefore create risks even before funds are directly removed.
That is why Astroport recommended withdrawing liquidity before providing a complete technical explanation of the incident. Removing liquidity can reduce users’ exposure while developers determine whether the suspected permissions were actually taken over and what actions an attacker could perform.
The available information does not yet confirm which specific administrator credentials were compromised, how the attacker obtained them, or whether those privileges were used to alter Astroport contracts.
What Comes Next
The investigation will focus on how the Neutron attack occurred, whether Astroport’s administrator privileges were compromised, and whether any contracts or user funds were affected. Neutron and Cosmos Hub validators will also assess when their networks can safely resume normal operations.
Astroport is expected to provide further updates as the investigation continues. For now, the protocol is urging users to withdraw liquidity from its pools while the incident’s scope remains unclear.
What This Means for You: Astroport liquidity providers should check the latest security updates before keeping funds in its pools. Terra users were told that Terra contracts were isolated from Neutron and that their funds were not affected. Cosmos Hub users may also face temporary disruptions to transactions and staking while the investigation continues.
