Neutron governance proposal 9 reassigned administration of Drop’s dATOM converter and withdrawal-manager contracts to the attacker. After the proposal passed, the attacker migrated both contracts to previously uploaded malicious code exposing a withdraw_all function and swept their entire balances. Drop’s liquid-staking or redemption logic itself was not exploited; the contracts were taken over through Neutron chain governance

The Drop project suffered an attack via a malicious governance proposal, through which the attacker transferred treasury funds, resulting in a loss of approximately $4.4 million.