# bridge exploit — X 热门讨论 (2026-09-23 02:58 UTC)
## @Airdrops_one (Grey Ledger) · 09-22 14:45 · ♥20 ↻0 💬6 The Neutron exploit started six months ago.
easy way to frame it: why a chain already being wound down was still carrying this much live financial state, and this much governance authority, in September.
March 16. @neutron_or announced the wind-down. Supervault deposits had closed the day before. DEX and Supervaults would move to withdrawal-only by April 17. Users were given dates to redeem or bridge out. Hadron Labs would maintain the network until June 30, then hand it to "low-maintenance mode with community support."
Two things to pay attention to:
1. Governance would move from Neutron's custom DAO to the standard Cosmos model, with a smaller validator set.
2. NTRN holders would be offered a USDC redemption, with the foundation's own ~32.4M NTRN burned.
June 30. Hadron's maintenance commitment ended.
July. The repos were archived. The core repo's notice: the development team was no longer monitoring the codebase or tracking security vulnerabilities.
So by summer, most of what you'd expect to leave in a wind-down was leaving. Developers, products, deposits, and custody support. Token holders had been offered an exit. NTRN traded around $0.0008, and the entire bonded stake marked at roughly $113K.
Other things remained too. @dropdotmoney had begun its own wind-down; its Neutron converter still held 1.59M ATOM. @astroport_fi still had about $4.9M in Neutron pools that had stopped trading. And governance could still use wasmd's privileged path to change contract admins and migrate their code, even where Neutron governance was not the current admin.
the important part: token got cheaper, while the authority attached to it did not.
September 19. Someone submits Proposal 9. It describes an AI governance experiment. Inside are eleven messages changing the admins of Astroport and Drop contracts. Expedited vote: three days, 67% threshold. Twelve wallets voted NO_WITH_VETO. They held 0.374%. Of eleven active validators, one voted at all. It voted NO.
September 22, 01:43 UTC. Per @Rarma_'s reconstruction, the account that carries most of the YES vote receives 20K USDC and buys 31.6M NTRN from Astroport pools. 02:13, it delegates. 02:24, voting closes. It had cast its vote two days earlier holding about 100 NTRN, but Neutron tallies the stake held when voting closes, so it now represents 84.74% of the YES. Cost: $20,199. The pools used to buy the voting power were among the contracts drained. The vote paid for itself.
02:38 to 03:02. Ten contracts migrated to code the attacker had uploaded, with one addition: withdraw everything. About $9.4M swept, most of it now frozen or unsettled rather than realized loss. No pricing bug. Astroport's governance keys not compromised. The contracts did what chain governance told them to do.
USDC toward Noble and Ethereum. ATOM to the Cosmos Hub and THORChain. Some made it out; IBC rate limits trapped more. 07:43, Neutron validators halt the chain. 11:18, Cosmos Hub validators halt the Hub with roughly 1.2M of the affected ATOM still sitting there.
So this isn't really about should the validators have halted Neutron faster this morning. By September, they were dealing with the last stage of a process that started in March.
Neutron wound down the product before it wound down the authority. https://x.com/Airdrops_one/status/2102409020677959963