A Cosmos Hub governance proposal that would return the ATOM validators seized after the Neutron attack is drawing a near-unanimous veto. By 2:34 p.m. ET on Friday, No with Veto votes made up about 95% of the roughly 69.3 million ATOM cast on proposal 1056, against about 174,300 ATOM in favor.

The proposal, which carries the title “ATOM Refund & Justice Bounty” on-chain, went up at 7:20 p.m. ET on Wednesday. Its text says “Cosmos Hub reps coordinated validators to unjustifiably steal 1.2M ATOM” from the attacker’s address, and it asks for 1,221,120 ATOM to be returned. It also offers a 500,000 ATOM “Justice Bounty” to yes voters, split by staking weight, paid over six months and capped at 5,000 ATOM per voter.

The message attached to the proposal would pay 1,721,120 ATOM out of the Hub’s community pool to the address that submitted it, which is a different address from the one the Hub swept.

How the Hub Took the ATOM

The ATOM came from Neutron, where a governance vote that closed on the night of Sept. 21 gave the attacker admin control of contracts run by Astroport and Drop. Validators halted and restarted the chain, and the restart on Wednesday moved the address’s remaining 1,227,121 ATOM into a 4-of-6 multisig.

In its weekly update on Thursday, the Hub team wrote that “there was no vulnerability on the Cosmos Hub” and that the patched software “touched exactly one account.” Any four of the multisig’s six signers, all Hub validators (Nansen, Keplr, Enigma, Silknodes, Kiln and Polkachu), must approve before the funds can move.

The Refund That Got Out

At 8:07 a.m. ET on Wednesday, minutes after the restart, the attacker’s address received 168,990.9 ATOM back from THORChain. The attacker had put 200,000 ATOM into a THORChain swap for ether on Sept. 22, and THORChain’s records show about 19.9 ETH went out before the swap hit its price limit and the rest was refunded. At 1:54 p.m. ET on Wednesday, the attacker sent 168,990 ATOM to an Osmosis address over IBC.

Voting on proposal 1056 closes on Sept. 30. The proposal fails if turnout stays below 40% of staked ATOM, and turnout stood at about 21% on Friday afternoon. If it clears that bar with No with Veto above 33.4% of the vote, it fails and its 500 ATOM deposit is burned.

Related Listen: How DeFi Remains Secure in a World of Always On AI Hacks: Uneasy Money