Neutron governance proposal 9 contained MsgUpdateAdmin messages that reassigned administration of Astroport contracts despite those contracts previously being administered by Astroport’s own governance contract. After the proposal passed, the attacker migrated Astroport Staking and six Astroport pair contracts to attacker-uploaded code containing a withdraw_all entry point and swept their balances. The attack did not exploit Astroport’s swap or pool logic

Astroport (a Cosmos ecosystem DEX) announced a security incident on the Neutron chain that may have resulted in the theft of admin privileges for its contracts. Neutron has halted chain operations for investigation, and the project advised users to immediately withdraw liquidity from all Astroport pools across chains. Terra-side contracts were unaffected.