
🚨 Cosmos recovered $2.2M in stolen ATOM after a 25-hour halt. But the attacker still got away with more. At restart, validators seized 1.227M cosmos:native from the attacker-linked address and moved the funds into a recovery multisig. Seven blocks later, a THORChain refund sent another 168,990 ATOM to that same address. Those tokens escaped the sweep, moved to Osmosis and were sold for roughly $266K in USDC before much of it was converted into ETH. The recovery worked. The timing window didn’t.

