Cosmos Hub halted for nearly a day and secured 1.23 million stolen ATOM on restart. Seven blocks later, another 168,990.9 ATOM reached the attacker-linked address, according to analyst Rarma.

That later batch came from a THORChain refund. It was sent to Osmosis and sold for about 266,841 USDC.