Cosmos User Reports Unauthorized 1,200 ATOM Transfer Amid Keplr Recovery

A Cosmos Hub user reported that roughly 1,200 staked ATOM moved from a Keplr wallet without permission on Nov. 10, days after Keplr and Web3Auth began securing wallets exposed to a previously disclosed vulnerability. On-chain records confirm the transfer landed at an address absent from the recovery list Keplr published on Nov. 8 — but they do not establish whether the recipient is an attacker or an participant in the recovery effort itself.

The user, posting under the name topaztodorov on the Cosmos Hub forum on Nov. 11, said the wallet had been created using Google login. The poster asked investigators to identify the recipient and locate the assets, while explicitly declining to accuse any specific party without evidence. That restraint matters: at this stage, the destination address is unattributed, and the recovery effort's own transactions may resemble an attacker's.

What do the on-chain records show?

The Nov. 10 transaction unwound a delegation of 1,200.473313 ATOM into transferable staking-share tokens and forwarded approximately 1,200.71 of those tokens to the reported destination address. The delegation sat with SG-1, a known Cosmos validator. A second transaction the same day moved an additional 16.198818 ATOM from the original wallet to a different address.

For practitioners, the mechanics are familiar. Converting a delegation into liquid staking-share tokens is the standard path for moving staked capital quickly — it avoids the roughly 21-day unbonding period that would otherwise freeze the funds. Whoever controlled the wallet at signing time understood that shortcut.

What does this change for wallet operators?

The incident sharpens two operational questions. First, recovery-side activity and attacker activity are now difficult to distinguish on-chain. Keplr's Nov. 8 recovery list gave users a reference set of legitimate addresses; a transfer to an address outside that set is a warning signal, not proof of theft. Investigators will need the recipient's counterparty history before drawing conclusions.

Second, wallets created through social login — Google credentials routed through Web3Auth — carry a distinct trust architecture compared with seed-phrase wallets. The user's account was exactly this type. When custodial key shards and OAuth flows sit in the transaction path, attribution after an incident depends on the infrastructure provider's records as much as on the chain itself.

At current network parameters, 1,200 ATOM represents a meaningful position for a single retail delegator — and the unauthorized conversion of staked shares into liquid tokens means the assets can move again immediately, with no waiting period slowing a further hop.

What happens next

The open questions are attribution and recovery. Topaztodorov has asked investigators to identify the recipient address controller; until Keplr, Web3Auth or community analysts tie that address to either the recovery effort or a third party, the roughly 1,217 ATOM in combined movements remains in limbo. Expect forum scrutiny of the two destination addresses to intensify in the coming days as the recovery window continues.