Drop

Neutron governance proposal 9 reassigned administration of Drop’s dATOM converter and withdrawal-manager contracts to the attacker. After the proposal passed, the attacker migrated both contracts to previously uploaded malicious code exposing a withdraw_all function and swept their entire balances.

Drop’s liquid-staking or redemption logic itself was not exploited; the contracts were taken over through Neutron chain governance.