Silence Is a Yes: 1inch, Neutron and the New Governance Attack

A $500 wallet, a $4.76 million treasury, and a clock

On September 14, 2026, a wallet that had existed for a matter of hours, with exactly six transactions to its name, submitted a proposal to one of the most heavily used pieces of infrastructure in decentralized finance. The target was the treasury of the 1inch DAO, the governance body behind the 1inch aggregator that routes trades across Ethereum, Arbitrum, Base and Optimism and sits alongside the on-chain venues now handling billions in daily volume. The wallet had been funded with roughly 0.2 ETH, about 500 dollars, most of it from an anonymous instant-swap service, according to an on-chain analysis of the attack. It posted a bond of 0.1 ETH and waited.

That was, in essence, the entire operation. No flash loan. No purchase of a controlling stake. Not a single 1INCH token bought. The attacker’s only unrecoverable expense was around 6 dollars in gas; the bond itself was refundable if nobody objected. On the other side of the wager sat a treasury Safe holding about 4.76 million dollars in USDC, ETH, wrapped Bitcoin and dozens of smaller tokens, per the same analysis. The math was grotesque: risk 6 dollars to potentially win millions.

The clock mattered more than the money. 1inch executes approved governance decisions through an optimistic system that treats an unchallenged proposal as true. If no one disputed the attacker’s proposal within a fixed window, it would finalize on its own, wait out a cooldown, and become executable against the treasury. Nothing would be hacked. The contracts would run exactly as written. All the attacker needed was for the right people to not be paying attention at the right moment.

This is not how the governance attacks of 2022 through mid-2026 worked, and that difference is the story. The earlier wave, the one that took Beanstalk for 182 million dollars and BonkDAO for 20 million, was about money: buy enough votes to win. The September attacks are about attention. They do not try to overpower honest participants. They exploit the fact that, most of the time, honest participants are not there.

The vote you win by not having one

For three years the governance attack had a recognizable shape. An attacker acquired voting power, usually by buying a governance token on the open market or borrowing a pile of it through a flash loan, submitted a proposal that moved the treasury to an address they controlled, and pushed it through a vote. The defining constraint was cost. To win a vote you generally had to out-hold or out-borrow everyone who might oppose you, and for large, liquid DAOs that got expensive.

The venture firm a16z crypto laid out the underlying economics in a widely cited 2022 essay, DAO governance attacks, and how to avoid them, by researchers Pranav Garimidi, Scott Kominers and Tim Roughgarden. Their model reduces the decision to a single line: an attack happens when the value of what can be seized exceeds the cost of acquiring the votes plus the cost of executing the attack. Push the cost of votes toward zero and the inequality almost always tips in the attacker’s favor. The whole discipline of governance defense, in their framing, is about keeping that cost high.

The September attacks did something the essay anticipated but that the market had not fully absorbed: they drove the cost of votes not merely low but effectively to nothing, by refusing to play the voting game at all. In the 1inch case the attacker did not buy 1INCH, which trades near 0.10 dollars for a market value around 146 million dollars, according to CoinGecko, down more than 98 percent from its 2021 peak. Buying a majority of that float would have cost tens of millions. Instead the attacker exploited the machinery that turns a decision into an on-chain action, and that machinery, it turns out, does not require a vote at all. It requires only silence.

That is the uncomfortable inversion at the center of this year’s incidents. Governance was designed so that doing something requires active approval. Optimistic governance flips the default: doing nothing becomes approval. And nothing is the one thing a distracted, under-resourced, largely absent token-holder base can be relied upon to do.

How optimistic governance turns silence into execution

To understand the 1inch attack you have to understand how the DAO turns a vote into money moving. Like many DAOs, 1inch votes off-chain on Snapshot, where holders of staked tokens signal support without paying gas. The problem with off-chain votes is that they are not self-executing; someone still has to make the on-chain transaction happen. 1inch bridges that gap with a Zodiac Reality Module, part of a family of tools sometimes branded SafeSnap, which lets a Snapshot result trigger a transaction on the DAO’s treasury Safe without the multisig signers approving each one by hand.

The Reality Module runs on an optimistic oracle, the same broad design that settles a lot of prediction-market and cross-chain questions, and the same design whose failure modes HOGE Wire has examined through prediction markets’ oracle problem. The logic is simple and, on a good day, elegant. Someone asks the oracle a question: did this proposal pass, and should the Safe run these transactions? Anyone can answer, and to answer they post a bond. If the answer goes unchallenged for a set window, the system treats it as true. Truth, here, is whatever nobody paid to dispute.

On 1inch the mechanics run like this, per the DAO’s own governance defense proposal. A proposer posts a “Yes” answer with a minimum bond of 0.1 ETH. To contest it, a defender must post an “Invalid” answer with a larger bond, and each new answer has to at least double the last, an escalating ladder. A 72-hour timeout resets every time a fresh bond arrives, and either side can escalate the fight to Kleros, a decentralized arbitration service, to have jurors decide who is right. If nobody contests the “Yes,” it finalizes, a further cooldown runs, and then the transactions can execute.

Read that again from an attacker’s point of view. You do not have to win an argument. You have to make a claim cheaply and hope no one shows up to argue it. The bond is not a wall; it is a toll you pay only if someone forces you to.

Anatomy of the 1inch attack

The September 14 proposal, tagged internally as a “wave3-drain” and identified by a long question hash, bundled five batched transactions whose contents would not be fully legible until they executed, according to the on-chain teardown that documented the attempt in detail. The attacker posted the “Yes” bond at 15:34 UTC. From that timestamp the calendar was fixed: absent a challenge, the answer would finalize three days later, a 72-hour cooldown would run, and execution against the roughly 4.76 million dollar treasury Safe would become callable around September 20, with the window expiring the following day.

The economics are worth restating because they are so lopsided. The wallet was funded with about 0.2 ETH, roughly 500 dollars at prices near 2,500 dollars per ETH, and the only genuinely spent money was around 6 dollars of gas. The 0.1 ETH bond comes back if the attack succeeds. The treasury it targeted held millions across USDC, hundreds of ETH, wrapped Bitcoin and a long tail of smaller tokens. The same analysis noted the September 14 attempt was not the first; it was one in a sequence, exactly what you would expect from a strategy whose per-attempt cost is a rounding error. As the analyst put it, the attacker keeps trying because the cost is near zero and they only need to succeed once.

That asymmetry, many attempts against a defender who has to be right every time, is the real vulnerability, and it is not in the code. 1inch’s contracts did what they were built to do. The treasury Safe is a 7-of-12 multisig with real people behind it. What the attacker probed was not a bug but a behavior: the assumption that when a fraudulent “Yes” appears, someone will notice within 72 hours, understand what they are looking at, hold enough ETH to post an escalating counter-bond, and be willing to risk it. On most days, for most DAOs, that is a tall stack of assumptions.

Neutron and the proposal that lied

If 1inch shows the silent attack in its purest form, the assault on Neutron a week later shows its deceptive cousin, and it did not stay an attempt. Neutron is a smart-contract platform in the Cosmos ecosystem, and its on-chain governance controls sensitive administrative powers over the applications built on it. On September 22 an attacker pushed through a proposal dressed up as a harmless experiment. Reporting described it as an “AI Agent Takeover,” an AI governance test; underneath the friendly label, the proposal carried eleven MsgUpdateAdmin messages, the Cosmos instruction that reassigns who controls a contract.

When it passed, those messages handed the attacker administrative control over ten contracts belonging to two of Neutron’s largest applications: Astroport, a decentralized exchange, and Drop, a liquid-staking protocol. Within roughly 24 minutes the attacker migrated and drained them, taking about 4.9 million dollars from Astroport and 4.4 million from Drop, per Protos, for total losses that security researchers put near 9.4 million dollars. The stolen funds were quickly scattered across Neutron, the Cosmos Hub, Noble, Axelar, dYdX, Osmosis and Ethereum.

The acquisition cost was trivial next to the prize. Reporting put the value of the NTRN the attacker needed at roughly 20,000 dollars. That is more than the 1inch attacker spent, but against a nine-million-dollar haul it is the same story in a different dialect: the governance token was cheap enough that buying influence was never the hard part. The hard part, for a defender, was reading an eleven-message payload hidden behind a cute name before a sleepy electorate waved it through.

Neutron’s attack was not a code exploit any more than 1inch’s would have been. The proposal used the chain’s governance exactly as designed. What failed was the human layer that governance quietly depends on: the assumption that voters read what they approve, and that a proposal’s description matches what its code actually does.

When a whole blockchain hit the brakes

The Neutron response is where the story turns genuinely strange, and genuinely important. Because the stolen assets were flowing toward the Cosmos Hub, the Hub’s validators did something almost unheard of: they coordinated to halt the entire blockchain. The network stopped producing blocks at height 33,086,740 and stayed dark for more than a day, restarting at 12:00 UTC on September 23, according to reporting on the shutdown. During the freeze the validators effectively trapped roughly 1.2 million ATOM, worth about 2.2 million dollars, in the attacker’s control.

Then, on restart, they moved it. Through coordinated software changes agreed among validators, the Cosmos Hub relocated about 1.23 million ATOM out of the exploiter’s wallet without the owner’s signature, as several outlets reported. The Hub’s official account framed the intervention narrowly, stating that “the Hub itself was not exploited and no funds were impacted apart from the assets moved from Neutron.” In other words: we were not hacked, we simply reached into a wallet we do not own and took the coins back.

That is a remarkable thing for a supposedly credibly neutral base layer to do, and it revives an old debate about who really governs a chain when the rules produce an outcome the community hates. The people who can freeze a network and reassign balances are its validators, the same social layer that decides upgrades on other chains, including the operators behind Ethereum’s home validators. When they act in concert, on-chain governance is revealed as something less than sovereign; there is a human court of last resort, and it can overrule the vote. Whether that is reassuring or alarming depends entirely on whether you trust the humans, a question that gets litigated loudly in the contested autopsies that follow every major hack.

Two families of governance attack

Put side by side, the incidents of the past few years split cleanly into two families. The first buys its way to a winning vote. The second exploits the assumption that anyone is watching the vote at all.

The top three share a logic: overwhelm honest voters with capital. Beanstalk is the archetype, a flash loan large enough to command a supermajority for the single block it took to execute, valued by Cointelegraph at 182 million dollars. BonkDAO spent around 4 million dollars of BONK to clear a quorum almost nobody else showed up for and walked away with 20 million. Term Finance, which lost 8.5 million dollars in August, is the important bridge case: it bought its votes the old way but died the new way, because it had a seven-day timelock and nobody used it.

The bottom two barely bought anything. The 1inch attacker put no capital at risk beyond gas. The Neutron attacker spent a few thousand dollars on tokens, but the purchase was incidental; the leverage came from a proposal that misrepresented itself to an electorate that was not reading. The distinction matters because the defenses that stop the first family, higher quorums, longer buy-in periods, snapshotting voting power from past blocks to kill flash loans, do almost nothing against the second. You cannot price out an attacker who is not buying votes.

The timelock that was a paywall

The most seductive false comfort in DAO security is the timelock. Put a delay between a passed proposal and its execution, the thinking goes, and the community will always have time to react to something malicious. Vitalik Buterin punctured that comfort years ago in an essay on moving beyond coin voting, writing that “timelocks are more like a paywall on a newspaper website than they are like a lock and key.” A paywall stops nobody who is determined; it just adds a step. A timelock only protects you if a competent, motivated party is watching during the delay and is able to act.

Term Finance is the cautionary tale. When an attacker took Term for 8.5 million dollars in August, the protocol was not naive; it had a seven-day timelock and veto rights for depositors, and it still lost most of a vault product. The security firms PeckShield and CertiK concluded the attack had targeted the voting mechanics rather than any flaw in the underlying smart contract code. The delay was there. The defender was not.

1inch layered its delays even more thickly: a 72-hour dispute window, a 72-hour cooldown after finalization, and a Security Council able to veto with a 7-of-12 vote during the execution timelock. On paper it is a fortress. In practice each of those windows is a paywall, and a paywall works only if someone is standing at the gate with exact change. The 1inch defense proposal concedes as much when it describes the DAO’s current posture as “ad-hoc coordination,” a polite way of saying that whether the fortress holds depends on which volunteers happen to be awake.

Read the calldata, not the title

Both September attacks relied on a gap that is embarrassingly basic: the words describing a proposal and the code the proposal will run are two different things, and almost nobody checks that they match. The 1inch proposal’s five transactions were not legible until execution. Neutron’s payload wore the label of an AI experiment while carrying eleven admin-seizure messages. It is the same trick that let an attacker take over the Tornado Cash DAO in 2023 with a proposal that imitated a legitimate one while hiding malicious code, as CoinDesk reported at the time.

Security researchers have started calling this the description-execution mismatch, and it is now a subject of formal study. A September 2026 paper, Mind the Gap: Detecting Description-Execution Mismatch Attacks in DAO Governance by Bowen Cai and colleagues, built a framework to simulate what a proposal actually does and compare it against the plain-language description voters see. The authors derived execution results for 92.7 percent of active DAOs and 89.3 percent of executed proposals in their dataset, and reported detection precision around 81.7 percent with recall of 98.3 percent, noting that “free-form descriptions and structured execution traces are hard to compare” for a human skimming a forum.

The uncomfortable implication is that the defense against a lying proposal may itself have to be automated, possibly with the same class of AI tools that attackers now invoke as camouflage. That is the double edge running through the whole verifiable-AI and agent economy debate: the machines that can read calldata faster than any human are also the machines that make a malicious proposal look like routine housekeeping. For now, the practical advice is unglamorous. Do not trust the title of a proposal. Someone has to read the transactions.

What actually stops a silent attack

The good news is that the defenses exist and are getting concrete. The 1inch community’s response is instructive precisely because it is so specific. Rather than redesign the governance system, the DAO proposed funding a dedicated Governance Defense Safe with 2.5 ETH, a small 2-of-3 multisig whose only permitted actions are posting “Invalid” bonds and paying Kleros arbitration fees when a malicious proposal appears, per the proposal on its forum. The budget splits into a bond reserve and an arbitration reserve, with a documented Kleros fee around 0.36 ETH per case. A monitoring bot watches the Reality Module for new proposals, checks them against Snapshot, and pre-composes the counter-bond transaction so a human signer can approve it in seconds rather than scrambling. Crucially, the bot cannot move funds on its own; it needs the multisig.

The security firm Blockaid, which has tracked the wave, recommends a similar layered posture. In its accounting, at least seven governance takeovers drained roughly 22 million dollars between June 9 and August 6 across Ethereum, Solana and Base, and its checklist runs from raising quorum and deposit thresholds, to snapshotting voting power from past blocks, to real execution timelocks with an empowered emergency pause, ring-fencing dangerous powers such as minting and treasury access, monitoring for sudden vote concentration and suspicious payloads, and independent transaction verification before anything executes. The table below sorts the main options by the layer of the problem they address.

None of these is a silver bullet, and several make the DAO less decentralized. That is not an accident; it is the core tension.

Every brake has a hand on it

Every defense that actually stops a silent attack works by putting a human in the loop, and every human in the loop is a point of centralization. The 1inch Defense Safe is a 2-of-3 multisig, and its signers even receive a good-faith safe-harbor from personal liability, matching the protection given to the DAO’s Security Council, which can veto proposals during the execution timelock. Neutron’s rescue came from validators who could halt a chain and move someone else’s coins. In each case the community traded a piece of its decentralization for the ability to hit the brakes.

This is the same knot that has always sat at the heart of on-chain governance. Ali Yahya, a general partner at a16z crypto, told Fortune earlier this year that crypto had “spent the last 10 years rediscovering the hard way that direct democracy is a bad idea.” The silent-attack wave is a brutal illustration. Pure, permissionless, optimistic governance, the kind that needs no trusted committee, is exactly the kind that fails when no one is watching. Adding a watcher closes the security hole and reopens the political one: who watches the watcher, and what stops the emergency committee from becoming the government?

There is no clean answer, only trade-offs a community has to choose consciously. A DAO can be maximally decentralized and accept that it is only as safe as the attention of its least reliable day. Or it can fund a small, accountable, ideally transparent defense layer and accept that it has recreated, in miniature, the trusted intermediary that crypto set out to abolish. What it cannot do is pretend the choice is not being made. Leaving the default at “silence is a yes” is itself a decision, and the attackers have noticed.

Is skipping the vote even a crime?

If an attacker follows every rule the protocol published, posts an honest bond, submits a valid proposal, and the code executes as written, what law did they break? This is not a rhetorical flourish; it is a live and unsettled question. The most important data point is the Mango Markets case. Avraham Eisenberg was convicted over a 2022 manipulation that netted about 110 million dollars, and in 2025 a federal judge vacated those convictions, the court reasoning in part that the protocol had operated as designed. When the machine does what it was built to do, prosecutors trying to prove fraud have a genuinely hard problem.

US regulators have staked out ground, but it is uneven. The Securities and Exchange Commission established as far back as its 2017 DAO Report that tokens issued by a “virtual” organization can be securities subject to federal law, which gives the SEC a hook when a DAO’s token looks like an investment contract. The Commodity Futures Trading Commission went further on liability, winning a default judgment against the Ooki DAO in which a DAO was held to be a “person” that could be sued, and its token-holders potentially on the hook. Neither line tells a victim protocol how to claw back funds from an anonymous wallet, which is why Neutron’s recovery came not from a court but from validators.

The gap is widest for the legal-but-hostile case, where an attacker breaks no code and arguably no law. Compound’s community learned this in 2024, when a group nicknamed the Golden Boys pushed Proposal 289, a request to move roughly 24 million dollars in COMP into a vault they would influence, and passed it 682,191 votes to 633,636 before agreeing to rescind it under pressure. Nobody was charged, because plausibly nobody broke a law. That is the frontier the silent attacks are pushing toward: theft that looks, on its face, like ordinary participation.

What holders and builders should check now

For a token holder, the lesson of September is that a governance token’s safety depends less on its price chart than on the plumbing that turns votes into transactions. A few questions separate a hardened DAO from a target.

• Does the protocol use optimistic execution (a Reality Module, SafeSnap, oSnap or similar)? If so, an unchallenged proposal can execute by default, and you should ask who is paid to challenge one.
• Is there a funded, staffed defender? A dedicated defense fund and a monitoring bot, like the one 1inch proposed, is the difference between a real dispute window and a theoretical one.
• Can you see the calldata? If a proposal’s on-chain actions are opaque or described only in vague language, treat that as a red flag, not a convenience.
• How concentrated is voting power, and how low is the quorum? A quorum almost nobody meets is an invitation, as BonkDAO showed.
• Is there an empowered emergency veto, and who holds it? A Security Council or guardian multisig can stop a malicious proposal, but it can also stop a legitimate one, so know who they are.
• Where does the treasury actually live? A treasury Safe controlled by an executable module is only as safe as that module’s dispute process.

For builders the takeaway is blunter. Assume you will be targeted, repeatedly, by attackers whose cost per attempt is a few dollars. Design so that stopping them does not depend on a hero volunteer noticing at 3 a.m. Fund the defense, automate the detection, make proposals legible, and decide in advance who is allowed to pull the emergency brake. The protocols that survived September did not have better contracts than the ones that did not. They had someone awake.

Frequently Asked Questions

What is a governance attack?

A governance attack is when someone uses a protocol’s own decision-making system, its votes, proposals and admin controls, to take actions the community never intended, most often draining the treasury. Unlike a code exploit, nothing is hacked; the smart contracts execute exactly as written. The 2026 wave has shifted from buying a winning vote toward exploiting inattention, as in the 1inch and Neutron incidents.

How did the 1inch DAO governance attack work?

1inch executes decisions through an optimistic oracle (a Zodiac Reality Module) that treats an unchallenged proposal as approved. In September 2026 an attacker funded a wallet with about 500 dollars, posted a proposal to drain the treasury Safe, and bet that nobody would dispute it within the challenge window. The attacker bought no 1INCH tokens; the only unrecoverable cost was around 6 dollars in gas.

How much did the Neutron governance attack steal?

A disguised proposal seized administrative control of ten contracts on Astroport and Drop and drained roughly 9.4 million dollars within about 24 minutes. The Cosmos Hub validators then halted the chain for more than a day and moved about 1.23 million ATOM out of the attacker’s wallet, recovering a portion of the funds.

Are governance attacks illegal?

It is unsettled. When a protocol executes exactly as designed, fraud is hard to prove, which is part of why an appeals judge vacated the Mango Markets convictions in 2025. US regulators have some hooks: the SEC’s 2017 DAO Report treats many DAO tokens as securities, and the CFTC won a judgment holding the Ooki DAO liable as a legal person. But an attacker who breaks no code and arguably no law occupies a genuine gray zone.

How can a DAO defend against a governance attack?

The strongest posture combines keeping the cost of votes high (quorum, deposits, past-block snapshots to kill flash loans), funding an active defender that will dispute malicious proposals, verifying that a proposal’s code matches its description, and holding an empowered emergency veto. Each of these adds a measure of centralization, which is the trade-off DAOs now have to make deliberately.

Anneke de Vries covers security and exploits for HOGE Wire.