Astroport exploit — $4.9M lost on Neutron
Astroport lost an estimated $4.9M on Neutron (malicious proposal), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.
Vuln-watch · relayed from the DeFiLlama hacks database; see Source & attribution below
Summary
Astroport lost an estimated $4.9M on Neutron (malicious proposal), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.
Incident
- Protocol: Astroport
- Date (UTC): 2026-09-22
- Estimated loss: $4.9M
- Chain(s): Neutron
- Technique: Malicious Proposal
- Classification: Governance
- Target: DeFi Protocol
Recommended actions
- Revoke token approvals granted to Astroport contracts until the project confirms they are safe
- Integrators: pause or delist affected assets and monitor for attacker fund movements
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
This 0xCERT advisory relays an incident recorded in the DeFiLlama hacks database (https://defillama.com/hacks). Figures are preliminary estimates and may be revised; refer to the project's own post-mortem for the authoritative record. Report additional details to 0xCERT at https://www.0xcert.com/report.
References
Indicators of compromise
All IOC feeds →- address0x9bfcca13b4ac907433ac68766e96309ac867f819Attacker forwarder wallet (Neutron post-mortem) · Ethereum
- address0xe149310eb8b1b3d9c471ccd81819d393621fba5cAttacker working wallet (Neutron post-mortem) · Ethereum
- address0xef6c5a31df984c8569236a0abc1f27580e2a5d54Attacker collection wallet (Neutron post-mortem) · Ethereum
- addressaxelar1dd25c4sshelrpfs0433apg24c5phrhk8ltvs7jAttacker wallet (Neutron post-mortem) · Axelar
- addresscosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4nAttacker wallet (Neutron post-mortem) · Cosmos Hub
- addresscosmos1ekgfga6vv4zdrrjn3dux6f62fuzektfnfh5mduAttacker voting wallet (Neutron post-mortem) · Cosmos Hub
- addresscosmos1erq7tre6nk0jfx203z8ey75g4m7yfrckh2nk3vAttacker key used to sell THORChain refund (Neutron post-mortem) · Cosmos Hub
- addressdydx1dd25c4sshelrpfs0433apg24c5phrhk8ju5u4yAttacker wallet (Neutron post-mortem) · dYdX
- addressneutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605Attacker wallet (Neutron post-mortem) · Neutron
- addressneutron1ekgfga6vv4zdrrjn3dux6f62fuzektfndgaehmAttacker voting wallet (Neutron post-mortem) · Neutron
- addressnoble1dd25c4sshelrpfs0433apg24c5phrhk8nx0sdaAttacker wallet (Neutron post-mortem) · Noble
- addressnoble1ekgfga6vv4zdrrjn3dux6f62fuzektfnp5pn4jAttacker voting wallet (Neutron post-mortem) · Noble
- addressosmo1dd25c4sshelrpfs0433apg24c5phrhk8n7fgrpAttacker wallet (Neutron post-mortem) · Osmosis
- addressosmo1erq7tre6nk0jfx203z8ey75g4m7yfrckl3qx87Attacker key used to sell THORChain refund (Neutron post-mortem) · Osmosis
- addresssecret1mru6cp7ft8cfasaye4g6vum52qygnkq0cgw0azKey used to fund the vote purchase (Neutron post-mortem) · Secret Network
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-09-22 · last updated 2026-10-08
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0143/signed.txt | gpg --verify