Keplr and Web3Auth recovery on Cosmos Hub and Osmosis

After a security incident affecting some Keplr wallets created through Google or Apple sign-in, Web3Auth moved funds to recovery addresses it later published. We traced representative transfers into two of those addresses and looked for payments back to users. We also followed a separate route from a publicly reported wallet through Osmosis and Axelar to two Ethereum payouts.

Incident records begin on 6 November. The recovery-account balances below were read at approximately 06:49 UTC on 9 November. All transaction times use UTC.

What the records distinguish

Keplr identified unauthorized activity affecting some accounts created through social login. Web3Auth paused the embedded wallet service that supports sign-in for third-party apps. The companies later published matching recovery addresses. On-chain transfers show where funds moved, while the companies’ notices identify the purpose of the recovery destinations. Keplr’s initial notice · Web3Auth service notice · Web3Auth recovery list · Keplr’s matching list.

A reported wallet moved funds before the recovery samples

A public loss report named a Cosmos Hub address and an Osmosis address. We found the same signing public key in transactions on both chains. On 6 November at 14:12:35, the Cosmos Hub address sent 3,755 ATOM over IBC, the protocol the two chains use to pass transfer messages. Osmosis recorded the matching packet 12 seconds later, crediting a representation of the ATOM to the other named address. This was the same transfer recorded on two chains. Public report and original research lead · Cosmos Hub send · Osmosis receipt.

The Osmosis wallet swapped several assets before sending two batches of bridged wrapped ether (WETH). Wrapped ether is a token that represents ether. Axelar routes a representation of it between chains. The 3,755 ATOM was one input to that wallet, which also received other assets. Axelar recorded both IBC packets, deducted fees and submitted matching contract calls to Ethereum. The Ethereum receipts confirm both executions. Internal calls in the two Ethereum transactions show the wrapped tokens converting to native ETH and reaching the same address. Axelar deducted a combined 0.000357328849747426 WETH in fees from the 6.1 WETH sent.

Read Figure 1 from top to bottom. The arrows follow the matched records from Cosmos Hub to the Osmosis wallet and then the two onward packets.

Figure 1. Selected on-chain route from the public loss report. Solid arrows represent observed transfers or matched bridge steps. The diagram is schematic and omits the other assets that entered the Osmosis wallet. The links below identify the source and destination records.

The two payouts reached 0x531f1d541fec4a6a6439e7651620f66f8d854c1d. The recipient made an onward transfer of 0.39247296 ETH between the two payouts. It also received funds in other transactions. The records establish the two payouts and the separate onward movement. The exact source of the onward payment and the recipient’s role remain open. Onward transaction.

What reached the published recovery addresses

An early Osmosis sweep moved liquid assets

On 6 November at 23:10:56, a wallet sent nine token denominations to the address later named by Web3Auth, including 1.313132 OSMO. Bitquery initially attributed the larger sweep to an attacker and revised its classification after the recovery disclosures. Its dollar estimate covers a wider set of chains and assets than the native balances in this report. Nine-denomination transfer · Bitquery’s 8 November correction.

Cosmos Hub moved claims on staked ATOM

In a bundle confirmed on 7 November at 09:57:04, one delegator changed where its staking rewards would go. It then turned 3,012.591649 staked ATOM into a transferable claim and sent the resulting share token to the recovery wallet. The record identifies the exact share-token denomination and shows it arriving there. A share token represents an existing stake. Moving it transfers the claim without first waiting to unstake, and the share token remains separate from liquid ATOM. Across the bundle, 13 tokenization messages specified 16,062.223948 ATOM of stake. Cosmos Hub recovery bundle.

Osmosis was still receiving staking rewards on 9 November

At 06:33:58, an Osmosis bundle changed reward withdrawal addresses and triggered three payouts into the disclosed recovery account. The recorded amounts add up to 3.219209 OSMO. The network’s distribution module sent them to the recovery account. Those credits increased the recovery balance, and a separate transfer would be needed to return that value to users. Osmosis reward bundle.

Checking for payments back to users

Account sequence counts how many times a standard account has used its transaction counter. Both recovery accounts were at zero. Searches for the accounts as message senders, transfer senders, coin spenders and IBC senders returned no matches. This is a scoped check of two addresses and the available indexes. It cannot establish whether another account or an off-chain process made a payment to a user. A verified return would require a payout record tied to the original affected wallet or an authenticated replacement destination.

The return status for the two checked recovery addresses is therefore no user payout verified. The strongest finding on the separate reported-loss route is a completed delivery of 6.099642671150252574 ETH to one recipient. Confirming it as theft attributable to this incident would require additional evidence linking that route to a compromised account and establishing that the transfers were unauthorized.

Evidence appendix

Cosmos Hub published recovery address

cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu

Osmosis published recovery address

osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw

Cosmos Hub wallet named in the public report

cosmos1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jv8yhqm

Osmosis wallet named in the public report

osmo1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jyuh8kf

The selected transaction records below preserve the full identifiers for independent verification.

Cosmos Hub · Reported-wallet IBC send

2026-11-06T14:12:35Z · Block 33754215 · 3755 ATOM

A296459EA166BF6E6A8262945C2481CF735F061897A74C76255ABDAF099D5A27

Osmosis · Matched IBC receipt

2026-11-06T14:12:47Z · Block 74296875 · 3755 ATOM in IBC representation

571D058FCB313EB453E2913A0CFF940D530A608DB98DC6F83BDECFABE38C5162

Osmosis · Reported wallet bridged WETH send

2026-11-06T14:26:34Z · Block 74297865 · 5400000000000000000 base units

C574EFB8370BC41BD25D3DE879EBFE113820E1BF62F15DE44ADEA8DD9CC00291

Axelar · Matched packet and Ethereum call

2026-11-06T14:26:35Z · Block 37354683 · 5399862946303386963 base units after fee

1C6E0D259923CA578FB6DBB6BAFA821DF2FE27167EE7DAF966D960B1DA2609DB

Ethereum · Final native payout

2026-11-06T14:28:23+00:00 · Block 26356407 · 5399862946303386963 wei

0x5435c0c2cbcf20f1d4e786d2f0e153e206093459bc2b0a11d509b366535bdef6

Ethereum · Separate onward movement

2026-11-06T14:30:23+00:00 · Block 26356417 · 392472960000000000 wei

0x7ce42ab772c8bf6952d7f719b9e0e3d244317375c18a78e8c013273057d484d2

Osmosis · Reported wallet bridged WETH send

2026-11-06T14:41:02Z · Block 74298910 · 700000000000000000 base units

4959DF31DF3FCAB57CDD9EAE6BA652C3395E509D82BF46AC95046FC62062FF55

Axelar · Matched packet and Ethereum call

2026-11-06T14:41:03Z · Block 37355165 · 699779724846865611 base units after fee

A71C80E464481F06A5696AB715B80F5560D22D88F8392B8D6BD064C9BAD913E8

Ethereum · Final native payout

2026-11-06T14:41:59+00:00 · Block 26356475 · 699779724846865611 wei

0xf1fcfe3291cceef96a326dd4a1257846ad711423253529e2c23cd44ad52821e2

Osmosis · Nine-denomination recovery send

2026-11-06T23:10:56Z · Block 74335672 · 1.313132 OSMO and eight other denominations

D1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9

Cosmos Hub · Recovery stake-tokenization bundle

2026-11-07T09:57:04Z · Block 33766653 · 16062.223948 ATOM specified in 13 tokenization messages

811DDF1FAE1551EA6F26317D3B7EAFF45912C780661BFE9F322C815CC8228DBA

Osmosis · Recovery reward credit

2026-11-09T06:33:58Z · Block 74574971 · 3.219209 OSMO

E434BBD8C9BD680B964FCF3E6E939B5B2424918D4D4F097DBA8EF73999DAFD35

State and transactions were checked against public Cosmos REST responses, Axelar packet events and message records, Ethereum JSON-RPC receipts and Blockscout internal-call records. Native balances use six decimal places. The two bridged WETH amounts and ETH payouts use 18. The bank balances are point-in-time holdings and exclude the value of staking claims, other denominations and other chains.