Cosmos Hub halted for 25 hours on September 22 after validators stopped their nodes to prevent stolen ATOM from flowing out following a governance exploit on Neutron. The attacker used a privilege escalation in Neutron's wasmd framework to control application administrators and move 1.7 million ATOM to Cosmos Hub, prompting validators to stop consensus to contain the damage. Validators then coordinated a recovery plan involving a state change to transfer the stolen funds to a multisig address.