Cosmos batch moves 2,265.59 staked ATOM from six accounts amid theft report and recovery claim
2,265.59 ATOM moved in one batch on Nov. 7
A Cosmos Hub transaction on Nov. 7 converted 2,265.59 staked ATOM from six accounts into transferable staking claims. The tokens were then sent to one address, according to The Defiant's analysis of onchain records.
One delegator reported theft. Web3Auth said it and its partners are carrying out recovery work after a security incident affecting Keplr wallets, which are wallets — accounts that hold crypto — for Cosmos users.
What is known so far
- The batch involved six accounts and one destination address.
- One user, posting as Stan on a Cosmos forum, identified one account as his.
- He said 356.009956 ATOM from that account was tokenized without his approval.
- Web3Auth said some recovery transfers have been mistaken for attacker activity.
- It remains unconfirmed whether the six accounts were affected by the wider breach.
How the batch moved staked ATOM
The transaction was recorded at 5:18 a.m. ET on Nov. 7. It had 27 messages in total.
Those messages included a tiny self-transfer, six changes to staking-reward withdrawal addresses, 10 stake-tokenization operations, and 10 transfers of the resulting share tokens. All six withdrawal addresses and all 10 tokenization-record owners were set to the same recipient. The memo read "lsm recovery batch." The memo alone does not show who operated the batch.
The Hub's liquid staking module, or LSM, converts a delegation into transferable tokens. Those tokens represent a claim on staked ATOM. This lets ownership change without waiting through the normal 21-day unbonding period. The underlying ATOM remains bonded. Redeeming the tokens restores an ordinary staking delegation rather than releasing immediately spendable ATOM.
The batch carried seven direct-mode signatures. One was for the fee-paying account. One was for each delegator. It used those signatures rather than an authz execution wrapper. The signer set explains how the batch acted for multiple accounts. It does not establish who controlled the keys or whether the owners approved it.
A later balance query showed the destination still held the full share-token amount sent from the account Stan identified.
What Web3Auth and Keplr say about the wider incident
Web3Auth disclosed a security issue on Nov. 6 and paused its embedded-wallet service. Keplr later described a Web3Auth infrastructure vulnerability. Keplr said the vulnerability exposed private keys for some users who signed in with Google or Apple.
Keplr said its help with recovery efforts means some social-login accounts may show reduced or empty balances. Web3Auth said it was preparing a verified list of recovery addresses. It warned users not to assume that an unfamiliar destination address is associated with an attacker.
What is confirmed and what is still unclear
The onchain records confirm the amount moved, the number of accounts, the time, and the destination set for the share tokens. Stan's report and his statement that he never signed the transaction are also confirmed as his stated position.
What is still unclear is whether the recipient is an attacker or a recovery operator. It is also unconfirmed whether the six accounts were affected by the breach that exposed some private keys. The purpose of the batch therefore remains unresolved.
What users were told to do next
In Nov. 7 guidance, Keplr told Google- and Apple-login users not to send new funds to those accounts. It told them to move remaining liquid assets to a recovery-phrase or hardware-wallet account. Keplr said wallets created with a recovery phrase or a hardware wallet were not affected.
Where this report came from
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.