Keplr User Reports 1,200 ATOM Move Amid Recovery Effort

A Cosmos Hub user reported that roughly 1,200 staked $ATOM moved without permission on Nov. 10, days after Keplr and Web3Auth began securing vulnerable wallets. Onchain records confirm the transfer to an address absent from the recovery list Keplr published on Nov. 8, but do not establish whether its controller is an attacker or part of the recovery effort.

The user, posting as topaztodorov on the Cosmos Hub forum on Nov. 11, said the Keplr wallet was created using Google login. The poster asked investigators to identify the recipient and locate the assets, while explicitly declining to accuse a specific party without evidence.

The Nov. 10 transaction converted a 1,200.473313 $ATOM delegation into transferable staking-share tokens and sent about 1,200.71 of those tokens to the reported destination. The validator was SG-1. A second transaction sent another 16.198818 $ATOM from the original wallet to a different address that day.

Both transactions carried a single signature using the same public key. Their successful execution establishes that the network accepted them, not that the wallet's owner knowingly approved them.

The distinction between theft and recovery matters here. Web3Auth said on Nov. 7 that it and its partners were moving assets from vulnerable wallets using the same access path as the original attacker. Keplr warned that these protective transfers could leave Google- or Apple-login accounts showing reduced or empty balances.

Keplr's Nov. 8 list identified a Cosmos Hub recovery address beginning cosmos1atuap9. The recipient in this user's transaction begins cosmos1txrsc6 and is not that listed address. Absence from that list alone is not proof of attacker control.

The Assets Entered Unbonding

The share tokens did not simply disappear after reaching the recipient. A later Nov. 10 transaction redeemed them into a delegation under the recipient address. The recipient's current unbonding record shows roughly 1,200.47 $ATOM being withdrawn from SG-1, with completion scheduled for Dec. 1. That locates the principal in the withdrawal process; it does not identify who controls the receiving wallet or guarantee a return to the poster.

For social-login users, Keplr's published guidance was not to send new funds to potentially affected accounts and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. Keplr said wallets created with a recovery phrase or hardware wallet were not affected, and cautioned that staked and locked assets made recovery more complex and slower.