{"investigation":{"slug":"drop-dropdotmoney","entity_name":"Drop (dropdotmoney)","trust_score":42,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Drop (also marketed as dropdotmoney) is a liquid staking derivative protocol for Cosmos Interchain assets, built on Neutron and backed by the Lido Alliance. On September 22, 2026, an attacker used a manipulated Neutron governance vote (Proposal 9) to seize administrative control of contracts across the Neutron ecosystem, and Drop's contracts were drained of an estimated $4.4 million as part of a combined roughly $9.3-9.4 million theft that also hit the Astroport exchange for about $4.9 million. Reporting attributes the loss to a flaw in Neutron's chain-level governance system rather than to any defect identified in Drop's own contract code; for the full mechanics of the governance takeover and Cosmos Hub's emergency response, see the related page 'Neutron DAO — Governance Takeover Exploit (September 2026)'.","sections":[{"content":"Drop is a liquid staking protocol built as an integrated application on the Neutron blockchain, designed to make staked Cosmos Interchain assets (such as ATOM and NTRN) productive in DeFi while remaining liquid. The protocol was onboarded to the Lido Alliance, a network of liquid staking protocols associated with Lido Finance, and describes its architecture as modular so that a failure in one component can be isolated. Drop also raised a seed round reported at $4 million led by CoinFund. By September 2026 it was commonly cited as among the larger liquid staking providers in the Cosmos ecosystem.","heading":"Background: Drop as a Cosmos Liquid Staking Protocol","sources":[{"url":"https://blog.lido.fi/introducing-drop-liquid-staking-protocol-for-the-interchain/","name":"Lido Blog: Introducing Drop: Liquid Staking Protocol for the Interchain","type":"official","credibility":1},{"url":"https://www.webull.com/news/11630220406645760","name":"Webull News: Drop Protocol Secures $4M in Seed Round Led by CoinFund","type":"news_article","credibility":2}],"severity":"low"},{"content":"In November 2025, roughly ten months before the Neutron governance exploit, the Drop Foundation announced an orderly wind-down of Drop Protocol operations, citing the 'current direction' of the Cosmos ecosystem and broader market conditions that made a sustainable token model no longer viable. The announcement cancelled a planned token generation event and the associated 'Droplets Program' airdrop, and said the dTIA and deINIT derivative assets would be gradually sunset with withdrawals kept open, while dATOM and dNTRN would continue to be supported. This decision predates and is not reported to be connected to the September 2026 exploit; it is included here only as background establishing that Drop was already in a partial wind-down when its contracts were drained.","heading":"Prior Wind-Down Announcement (Unrelated to the Later Exploit)","sources":[{"url":"https://medium.com/@drop_protocol/drop-to-wind-down-operations-b2fa6138d03a","name":"Drop Protocol (Medium): Drop to Wind Down Operations","type":"official","credibility":1}],"severity":"low"},{"content":"On September 22, 2026, an attacker exploited Neutron's on-chain governance system by acquiring a large stake of NTRN tokens shortly before an expedited governance vote closed, passing a proposal that reassigned administrative control of roughly ten to eleven smart contracts integrated with Neutron, including contracts belonging to Drop and to the Astroport decentralized exchange. Using this admin control, the attacker migrated the affected contracts to malicious code and drained assets from them. Reporting places Drop's losses at approximately $4.4 million, described by one analyst as comprising roughly $3 million in ATOM, about $1.2 million in USDC, roughly $100,000 in DYDX, and smaller amounts of wstETH and WETH; Astroport's parallel loss in the same attack is reported at approximately $4.9 million, for a combined total of roughly $9.3-9.4 million across both protocols. The detailed mechanics of the governance proposal, the attacker's token acquisition, and Cosmos Hub's halt-and-recovery response are covered on the related page 'Neutron DAO — Governance Takeover Exploit (September 2026)' and are not repeated in full here.","heading":"Drop Contracts Drained in the September 22, 2026 Neutron Governance Exploit","sources":[{"url":"https://www.kucoin.com/news/flash/neutron-governance-proposal-manipulated-4-4m-stolen-in-cosmos-hack","name":"KuCoin News Flash: Neutron Governance Proposal Manipulated, $4.4M Stolen in Cosmos Hack","type":"news_article","credibility":2},{"url":"https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/","name":"Protos: Cosmos Hub halts for 24 hours after Neutron governance attack","type":"news_article","credibility":2},{"url":"https://publicaml.org/news/2026-09-22-astroport/","name":"PublicAML: Astroport Suffers $4.9 Million Loss from Malicious Proposal","type":"research","credibility":2},{"url":"https://publicaml.org/september-2026-crypto-hacks","name":"PublicAML: September 2026 crypto hacks: $766M — where the money is now","type":"research","credibility":2}],"severity":"critical"},{"content":"Available reporting describes the exploit as a failure of Neutron's chain-level governance design rather than a bug discovered in Drop's own smart contracts. Accounts of the incident describe the malicious proposal as granting the attacker admin rights over contracts that Neutron's governance did not itself own in the ordinary sense, effectively letting a low-cost, last-minute governance vote override the admin permissions of independently built protocols. No security researcher, auditor, or news outlet reviewed in this investigation has published a finding that Drop's contract logic itself contained an exploitable flaw; the loss is consistently framed as downstream of Neutron allowing contract administration to be reassigned through an expedited proposal with a low quorum and voting-power threshold relative to the value secured. This attribution should be treated as the consensus framing in contemporaneous reporting rather than as the conclusion of a formal, Drop-specific post-mortem, since no such document from Drop or an independent auditor was located.","heading":"Root Cause Attributed to Neutron's Governance Layer, Not Drop's Contract Code","sources":[{"url":"https://www.kucoin.com/news/flash/neutron-governance-proposal-manipulated-4-4m-stolen-in-cosmos-hack","name":"KuCoin News Flash: Neutron Governance Proposal Manipulated, $4.4M Stolen in Cosmos Hack","type":"news_article","credibility":2},{"url":"https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/","name":"Protos: Cosmos Hub halts for 24 hours after Neutron governance attack","type":"news_article","credibility":2}],"severity":"high"},{"content":"Validators on the Cosmos Hub halted block production at block height 33,086,740 in direct response to the Neutron attack, keeping the network offline for roughly 24-25 hours before resuming operations and executing a one-time state-level transfer of approximately 1,227,121 ATOM (reported at roughly $2.2 million) from attacker-linked addresses into a validator-controlled multisig. One account places the attacker's successful extraction before containment at only about 20% of the combined Astroport-and-Drop exposure, with the remainder trapped by the halt. It is not established in available reporting what portion, if any, of the recovered or frozen funds is specifically earmarked for Drop depositors as opposed to Astroport's, and no Drop-specific fund-recovery or user-reimbursement plan was identified. A subsequent Cosmos Hub proposal that would have returned roughly 1.2 million seized ATOM to the attacker's wallet, along with a 500,000 ATOM 'bounty' for supporting voters, was rejected by Cosmos Hub voters with roughly 94-95% of votes cast as 'NoWithVeto.'","heading":"Partial Containment via Cosmos Hub's Emergency Halt","sources":[{"url":"https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/","name":"Protos: Cosmos Hub halts for 24 hours after Neutron governance attack","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/cosmos-hub-restarts-after-25-hour-downtime-recovers-1-227m-atom-from-neutron-attack","name":"KuCoin News Flash: Cosmos Hub Restarts After 25-Hour Downtime, Recovers 1.227M ATOM from Neutron Attack","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/cosmos-hub-atom-refund-veto-vote/","name":"CryptoBriefing: Cosmos Hub proposal for ATOM refund faces 95% veto vote","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/cosmos-hub-voters-are-vetoing-a-proposal-to-refund-the-neutron-attacker-1-2-million-atom/","name":"Unchained: Cosmos Hub voters are vetoing a proposal to refund the Neutron attacker 1.2 million ATOM","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The exploit exposed a structural mismatch on Neutron between the relatively low cost of acquiring decisive governance voting power and the much larger value of the externally built protocol contracts that Neutron's governance could administratively control. The attacker reportedly spent only about $20,199 to acquire enough staked NTRN to swing an expedited vote that exposed roughly $9.3-9.4 million in third-party protocol funds. Commentary following the attack frames it as the third notable security incident to affect the Cosmos ecosystem within a short span, following a bug in a Cosmos-related EVM module and an exploit affecting Osmosis's Nomic bridge, and discussion continued within Cosmos Hub governance about whether validators who allowed the malicious proposal to pass should face penalties. As of this writing, no source reviewed describes a structural fix — such as a higher quorum, a longer timelock, or removal of Neutron governance's ability to reassign admin rights on contracts it does not operationally own — as having been implemented, meaning the underlying governance-cap-to-TVL imbalance that enabled the Drop and Astroport losses appears to remain in place for any protocol, including Drop's surviving dATOM and dNTRN positions, that continues to rely on Neutron's native admin model.","heading":"Structural Risk: Governance Weight Versus Protocol TVL Remains a Live Concern","sources":[{"url":"https://www.kucoin.com/news/flash/neutron-governance-proposal-manipulated-4-4m-stolen-in-cosmos-hack","name":"KuCoin News Flash: Neutron Governance Proposal Manipulated, $4.4M Stolen in Cosmos Hack","type":"news_article","credibility":2},{"url":"https://publicaml.org/september-2026-crypto-hacks","name":"PublicAML: September 2026 crypto hacks: $766M — where the money is now","type":"research","credibility":2}],"severity":"high"},{"content":"No dedicated public statement from Drop Protocol or the Drop Foundation specifically addressing the September 2026 loss of its contract funds, remediation steps taken, or any plan to make affected users whole was located during this investigation. This is noted as a gap in available information rather than as evidence of any specific wrongdoing; it is possible such a statement exists but was not indexed by the sources searched. Readers should treat the absence of a located statement as low-confidence information about Drop's response, not as confirmation that no response occurred.","heading":"Absence of a Dedicated Public Post-Incident Statement from Drop","sources":[],"severity":"medium"}],"timeline":[{"date":"2025-11","event":"The Drop Foundation announces an orderly wind-down of Drop Protocol operations, citing unfavorable market conditions and an unsustainable token model; dATOM and dNTRN continue to be supported.","source":"Drop Protocol (Medium)","source_url":"https://medium.com/@drop_protocol/drop-to-wind-down-operations-b2fa6138d03a"},{"date":"2026-09-22","event":"A manipulated Neutron governance proposal (Proposal 9) passes, transferring admin control of contracts including Drop's to an attacker, who migrates them to malicious code and drains an estimated $4.4 million from Drop (alongside $4.9 million from Astroport in the same attack).","source":"CryptoBriefing","source_url":"https://cryptobriefing.com/cosmos-hub-atom-refund-veto-vote/","date_evidence":"On September 22, 2026, an attacker exploited governance vulnerabilities within the Neutron protocol."},{"date":"2026-09","event":"Cosmos Hub resumes block production after roughly 24-25 hours of validator-ordered downtime, having moved approximately 1.227 million ATOM linked to the attack into a validator-controlled multisig.","source":"KuCoin News Flash","source_url":"https://www.kucoin.com/news/flash/cosmos-hub-restarts-after-25-hour-downtime-recovers-1-227m-atom-from-neutron-attack","date_evidence":"When operations resumed on September 23, validators executed a one-time state-level change, transferring 1,227,121 ATOM from the attacker's reach into a multisig address for safekeeping.","date_original":"2026-09-23"},{"date":"2026-09","event":"A Cosmos Hub proposal seeking to refund roughly 1.2 million seized ATOM to the attacker's wallet, plus a 500,000 ATOM 'bounty,' is rejected with approximately 94-95% of votes cast as 'NoWithVeto.'","source":"Unchained","source_url":"https://unchainedcrypto.com/cosmos-hub-voters-are-vetoing-a-proposal-to-refund-the-neutron-attacker-1-2-million-atom/"}],"sources_used":[{"url":"https://blog.lido.fi/introducing-drop-liquid-staking-protocol-for-the-interchain/","name":"Lido Blog: Introducing Drop: Liquid Staking Protocol for the Interchain","type":"official","archive_url":"http://web.archive.org/web/20260727173038/https://blog.lido.fi/introducing-drop-liquid-staking-protocol-for-the-interchain/","credibility":1,"archive_timestamp":"2026-07-27T17:30:38+00:00"},{"url":"https://www.webull.com/news/11630220406645760","name":"Webull News: Drop Protocol Secures $4M in Seed Round Led by CoinFund","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://medium.com/@drop_protocol/drop-to-wind-down-operations-b2fa6138d03a","name":"Drop Protocol (Medium): Drop to Wind Down Operations","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.kucoin.com/news/flash/neutron-governance-proposal-manipulated-4-4m-stolen-in-cosmos-hack","name":"KuCoin News Flash: Neutron Governance Proposal Manipulated, $4.4M Stolen in Cosmos Hack","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/","name":"Protos: Cosmos Hub halts for 24 hours after Neutron governance attack","type":"news_article","archive_url":"http://web.archive.org/web/20260927080031/https://protos.com/cosmos-hub-halts-for-24-hours-after-neutron-governance-attack/","credibility":2,"archive_timestamp":"2026-09-27T08:00:31+00:00"},{"url":"https://publicaml.org/news/2026-09-22-astroport/","name":"PublicAML: Astroport Suffers $4.9 Million Loss from Malicious Proposal","type":"research","archive_url":"http://web.archive.org/web/20261006181046/https://publicaml.org/news/2026-09-22-astroport/","credibility":2,"archive_timestamp":"2026-10-06T18:10:46+00:00"},{"url":"https://publicaml.org/september-2026-crypto-hacks","name":"PublicAML: September 2026 crypto hacks: $766M — where the money is now","type":"research","archive_url":"https://web.archive.org/web/20261006220235/https://publicaml.org/september-2026-crypto-hacks/","credibility":2,"archive_timestamp":"2026-10-06T22:02:35+00:00"},{"url":"https://www.kucoin.com/news/flash/cosmos-hub-restarts-after-25-hour-downtime-recovers-1-227m-atom-from-neutron-attack","name":"KuCoin News Flash: Cosmos Hub Restarts After 25-Hour Downtime, Recovers 1.227M ATOM from Neutron Attack","type":"news_article","archive_url":"https://web.archive.org/web/20261006220243/https://www.kucoin.com/news/flash/cosmos-hub-restarts-after-25-hour-downtime-recovers-1-227m-atom-from-neutron-attack","credibility":2,"archive_timestamp":"2026-10-06T22:02:43+00:00"},{"url":"https://cryptobriefing.com/cosmos-hub-atom-refund-veto-vote/","name":"CryptoBriefing: Cosmos Hub proposal for ATOM refund faces 95% veto vote","type":"news_article","archive_url":"http://web.archive.org/web/20261006200745/https://cryptobriefing.com/cosmos-hub-atom-refund-veto-vote/","credibility":2,"archive_timestamp":"2026-10-06T20:07:45+00:00"},{"url":"https://unchainedcrypto.com/cosmos-hub-voters-are-vetoing-a-proposal-to-refund-the-neutron-attacker-1-2-million-atom/","name":"Unchained: Cosmos Hub voters are vetoing a proposal to refund the Neutron attacker 1.2 million ATOM","type":"news_article","archive_url":"https://web.archive.org/web/20261006212505/https://unchainedcrypto.com/cosmos-hub-voters-are-vetoing-a-proposal-to-refund-the-neutron-attacker-1-2-million-atom/","credibility":2,"archive_timestamp":"2026-10-06T21:25:05+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-06T20:10:10.015845+00:00","updated_at":"2026-10-06T22:03:02.450266+00:00"},"source_quality":{"total":10,"tier1":0,"tier2":0,"tier3":0,"unrated":10},"follower_count":null}