Cosmos Batch Moves 2,266 Staked ATOM From Six Accounts

A Nov. 7 Cosmos Hub transaction converted 2,265.59 staked $ATOM from six accounts into transferable staking claims and sent those tokens to one address, according to The Defiant’s analysis of onchain records.

The movement prompted a theft report from one delegator, but its purpose is unresolved. Web3Auth says it and its partners are conducting whitehat recovery operations following a security incident affecting Keplr wallets. The company has warned that some recovery transfers have been mistaken for attacker activity.

A Cosmos forum user posting as Stan identified one of the six accounts as his and said 356.009956 $ATOM had been tokenized without his approval. “I never signed this transaction and never granted authz permissions to anyone,” he wrote in his report. The transaction contains the account and amount he identified.

How the Batch Moved Staked $ATOM

The successful transaction was recorded at 5:18 a.m. ET on Nov. 7. Its 27 messages comprised a tiny self-transfer, six staking-reward withdrawal-address changes, 10 stake-tokenization operations and 10 transfers of the resulting share tokens. All six withdrawal addresses and all 10 tokenization-record owners were set to the same recipient. The memo read “lsm recovery batch,” which does not itself establish who operated it.

The Hub’s liquid staking module, or LSM, converts a delegation into transferable tokens representing a claim on staked $ATOM. That lets ownership change without waiting through the normal 21-day unbonding period. The underlying $ATOM remains bonded; redeeming the tokens restores an ordinary staking delegation rather than releasing immediately spendable $ATOM.

The batch carried seven direct-mode signatures: one for the fee-paying account and one for each delegator. It used those signatures rather than an authz execution wrapper to carry out the batch. The signer set explains how the batch acted for multiple accounts, but does not establish who controlled their keys or whether their owners approved it.

A subsequent balance query showed that the destination still held the full share-token amount sent from the account Stan identified.

Breach and Recovery

Web3Auth disclosed a security issue on Nov. 6 and paused its embedded-wallet service. Keplr later described a Web3Auth infrastructure vulnerability that exposed private keys for some users who signed in with Google or Apple.

Keplr said its assistance with recovery efforts means some social-login accounts may show reduced or empty balances. Whether the six accounts in this batch were affected by that breach, and whether their recipient is an attacker or a recovery operator, remains unconfirmed.

In its Nov. 7 guidance, Keplr told Google- and Apple-login users not to send new funds to those accounts and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. It said wallets created with a recovery phrase or hardware wallet were not affected.

Web3Auth said it was preparing a verified list of recovery addresses to distinguish protective transfers from potentially malicious transactions. “Please do not assume that an unfamiliar destination address is associated with the attacker,” it warned.