- A 27-message batch transaction executed on November 7 utilized the Cosmos Hub Liquid Staking Module (LSM) to transfer staked $ATOM across multiple accounts without the standard 21-day unbonding period.
- The on-chain activity follows a disclosed Web3Auth infrastructure security vulnerability that exposed private keys for certain Keplr users accessing wallets via Google or Apple logins.
- While Keplr confirmed participating in ongoing recovery actions, officials caution that unfamiliar destination addresses should not automatically be classified as malicious while verified address lists are prepared.
Analysis of the 27-Message LSM Recovery Batch
On-chain records show that a complex batch transaction was executed at 5:18 a.m. ET on November 7 on the Cosmos Hub. Labeled with the memo text “lsm recovery batch,” the single transaction consolidated 27 distinct messages. These actions included a nominal self-transfer, six changes to staking-reward withdrawal addresses, 10 individual stake-tokenization operations, and 10 separate transfers of the resulting share tokens. Across the entire operation, all six reward withdrawal destinations and all 10 tokenization records were redirected to a single designated recipient address.
The technical mechanism relied on the Cosmos Hub Liquid Staking Module (LSM), an infrastructure component designed to turn locked staking delegations into transferable share tokens representing claims against staked $ATOM. Because the LSM permits asset ownership to be reassigned instantly without waiting through the protocol’s standard 21-day unbonding delay, the assets were redirected while the underlying $ATOM remained actively bonded. When these converted share tokens are eventually redeemed, they restore standard staking delegations to the holder rather than releasing liquid, immediately spendable $ATOM tokens. Subsequent balance queries confirmed that the destination address maintained the complete sum of share tokens originally linked to an account identified by Stan.
To authorize the multi-account process, the batch leveraged seven direct-mode signatures instead of utilizing an authz execution wrapper. This authorization profile consisted of one signature from the designated fee-paying account alongside individual signatures corresponding to each of the six delegator accounts. Although the cryptographic configuration explains how the batch successfully commanded actions across diverse accounts simultaneously, the signatures alone do not reveal which party held key control or whether the respective account owners authorized the migration.
Web3Auth Infrastructure Breach and Keplr Wallet Vulnerability
The transaction occurred directly in the wake of an infrastructure compromise disclosed on November 6, when authentication provider Web3Auth identified a security flaw and suspended its embedded-wallet service. Keplr later clarified that the vulnerability stemmed from Web3Auth infrastructure, exposing the underlying private keys of certain users who accessed their wallets using Google or Apple social-login methods. Users managing accounts derived via standard 12- or 24-word recovery phrases or hardware wallets were not impacted by the incident.
Following the discovery, Keplr engaged in remediation measures, warning its community that active recovery operations could cause some social-login accounts to temporarily display reduced or zeroed balances. At present, it remains unconfirmed whether the specific six accounts involved in the November 7 batch transaction were compromised by unauthorized actors or if their assets were extracted by an official incident-response team carrying out white-hat salvage operations.
Why This Matters
The event highlights the growing intersection of social-login key management solutions and complex decentralized finance mechanics like liquid staking. While social sign-ins drastically lower onboarding barriers for mainstream crypto adoption, centralized infrastructure vulnerabilities can leave multiple accounts simultaneously exposed. Utilizing protocol features like the Liquid Staking Module provides an expedient route to secure or liquidate bonded positions rapidly, bypassing standard three-week safety delays originally designed to deter hasty exits and network destabilization.
In response to the confusion surrounding active address changes and fund movements, Keplr issued guidance on November 7 advising all users relying on Google and Apple logins to halt inbound transfers immediately and transfer all remaining liquid assets to secure recovery-phrase or hardware-wallet setups. Concurrently, Web3Auth announced that it is compiling a public, verified registry of official recovery addresses to help users and blockchain analysts differentiate between legitimate protective evacuations and exploitative theft. In their statement to the public, Web3Auth warned: “Please do not assume that an unfamiliar destination address is associated with the attacker,”
urging caution while tracing fund flows.
Frequently Asked Questions
What is the Cosmos Hub Liquid Staking Module (LSM), and why was it used here?
The LSM allows users on the Cosmos Hub to tokenize their active delegations into transferrable share tokens without needing to wait for the standard 21-day unbonding period. In this scenario, it allowed the operators of the batch transaction to transfer control of bonded $ATOM instantly to a single destination address while preserving its staked status.
Were all Keplr and Cosmos wallet users affected by this incident?
No. Keplr confirmed that users who set up their wallets using traditional seed phrases (recovery phrases) or hardware devices like Ledger were unaffected. The vulnerability was isolated to users utilizing Web3Auth-powered Google or Apple social-login infrastructure.
Are the funds redirected to the batch address lost or recovered?
It remains unconfirmed whether the recipient address belongs to a malicious actor or an authorized recovery operator conducting white-hat asset preservation. Web3Auth is preparing a verified registry of recovery addresses to clarify the final destination of transferred assets.
