Defend Against Cybercrime with the Power of Community

On November 10, 2026, an Ethereum wallet lost 148.599522645 aWETH across four transactions during the Across Protocol domain hijack. Roughly four fifths went to one wallet and one fifth went to a second, which Bitquery identified as the drainer fee wallet. The collector later funded a wallet that sent the funds out on three routes. A downstream Bitcoin payment records the exact hash of its Ethereum input, giving investigators a way to verify one of those routes. A day later, the same address bridged 40,659.841619 USDT from X Layer to Ethereum. The bridge records identify who initiated that transfer. Four earlier liquidity withdrawals and two later swaps explain how the wallet assembled the amount bridged. A link to an Across reimbursement remains unverified.Verified route segments. Ethereum victim → collector and fee wallet in aWETH. Separately, the collector → splitting wallet in ETH → a THORChain-linked input → Bitcoin output. The splitter’s second verified cross-chain branch reached Solana via Chainflip. The third branch went through Arbitrum to two Hyperliquid accounts, where the USDC was used to buy XMR1.ScopeDetailIncident10 November 2026 UTCEvidence cutoff12 November 2026, 00:06 UTCIncident-wide estimateBitquery reported about $348,000 from nine wallets on Ethereum, Arbitrum, Base, BNB Chain and Optimism. Its observed outflows ran from 19:02 to 21:53 UTC. This report independently reconciles the Ethereum wallet below and checks selected downstream records.CompensationAcross pledged reimbursement. Payment to a verified incident victim from an authenticated Across source remains unverified.How the incident beganAcross attributed the takeover of its official website address to social engineering at its domain registrar. Control of the address allowed a phishing page to appear where users expected the bridge interface. The project later reported that it had restored access and committed to compensating affected users. Bitquery's investigation describes a wallet drainer, software that uses permissions obtained from a victim to move assets. The records examined here show wallet transfers and their destinations. The registrar account compromise is described in the project's account of the incident. Across restoration update, Bitquery incident investigation.What left the victim walletAave issues aWETH to represent a WETH deposit. WETH is an Ethereum token representing ETH. Transferring the receipt token moves the claim on the deposited asset. Redeeming it or converting the proceeds later moves value already accounted for in the original loss.Start at the top of Figure 1 and follow the two arrows to the addresses that received the aWETH. The wallet that submitted the first transaction is different from the victim address recorded in the token logs. The amounts below use the token logs to identify the source and recipients.Figure 1. Each solid arrow represents the aggregate of four verified transfers to one recipient. Amounts are rounded for the diagram. Arrow width and spacing are schematic. The table preserves the exact amounts.10 Nov UTCCollector aWETHFee wallet aWETHEvidence20:09:23115.23141856629925367228.807854641574813418First transfer pair20:12:113.4425131230170735310.860628280754268382Second pair20:12:230.1028432133575674110.025710803339391852Third pair20:12:230.1028432133575674110.025710803339391852Fourth pairTotal118.87961811603146202529.719904529007865504148.599522645039327529 aWETHBoth 20:12:23 transactions succeeded and had distinct hashes. The calculation excludes Aave accounting mints, unrelated tokens in the same receipts and later conversions. The repeated split supports the collector and fee roles assigned by Bitquery. The logs identify the receiving addresses.The two recipients converted and moved funds separatelyAfter the first split, Ethereum execution traces record 28.823367170220056748 ETH and 0.912049936711908441 ETH entering the fee wallet from the WETH contract. These transfers are conversion evidence. Their amounts include activity at the wallet level, so they cannot be counted as additional victim losses. The fee wallet also had ETH receipts before the incident. An incident-wide loss total cannot be derived from its balance. First WETH-to-ETH trace, second trace, pre-incident receipt.At 20:11:35 UTC, an execution trace records 115.185264363588230966 ETH entering the collector. At 20:17:59 UTC the collector sent 146.268685820 ETH to a splitting wallet. The collector had additional inflows, including a 20.733627715165981828 ETH trace at 20:06:47 UTC whose funding origin was not established. The downstream route therefore tracks value from the collector without assigning every unit to the Ethereum victim above. Collector conversion trace, splitter funding, unattributed ETH trace.UTCEthereum transferEvidence10 Nov, 20:36:59Splitter → wallet later observed sending ETH to two Hyperliquid-linked addresses, 48.809535430 ETHTransaction10 Nov, 20:37:23Splitter → wallet later observed sending 48.8 ETH to a reported Chainflip deposit, 48.809535430 ETHSplitter transfer, 48.8 ETH send10 Nov, 20:51:35Splitter → THORChain-linked Ethereum input, 47.000201860 ETHTransaction10 Nov, 20:54:11Collector → side wallet, 11.636137960 ETHTransaction11 Nov, 01:20:47Collector → second side wallet, 3.425730160 ETHTransaction11 Nov, 18:43:11Splitter → another Ethereum address, 1.436231320 ETHTransactionStart at either Ethereum input in Figure 2 and read down to the corresponding settlement. The Bitcoin payment and the Chainflip swap use different records to connect the two chains.Figure 2. Solid arrows show transaction-level matches. Each pair is a separate settlement. Blue marks the Ethereum input and the other colors distinguish the destination networks. The diagram omits intermediate protocol activity. The records below show how each match was made.The Bitcoin output identifies the Ethereum transaction in its own data. The Solana payout is tied back through a separate Chainflip record.The Bitcoin payment names its Ethereum inputA Bitcoin transaction can include a data-only output. Here that output contains the word OUT followed by the exact Ethereum transaction hash for the 47.000201860 ETH send. Bitquery attributes the swap to THORChain. Both Bitcoin sources show output 0 paid 1.30506375 BTC to the same address in block 975354 at 22:36:46 UTC on November 10. The output was unspent when queried. Ethereum input, Bitcoin transaction and data output, independent Bitcoin transaction view.Solana records show both onward paymentsChainflip records a successful 48.8 ETH deposit and names the matching Solana payout signature in swap 2053940. The destination received 1,197.033564583 SOL after the broadcast fee. The two subsequent pairs of transfers are independently visible on Solana. Chainflip swap 2053940.10 Nov UTCSolana movementEvidence21:14:061,197.033564583 SOL → initial Solana recipientReceipt23:50:22 and 23:58:18Initial recipient → intermediate wallet, 1,197.032754476 SOL across two transfersFirst send, second send23:50:44 and 23:58:38Intermediate wallet → final observed address, 1,197.032734399 SOL across two transfersFirst send, second sendBitquery labels the final address as a Rainbet wallet. The transfer is verifiable on Solana. Account ownership, a customer credit and any further withdrawal would require additional records. Bitquery service attribution.Hyperliquid records show USDC deposits and XMR1 tradesThe Ethereum funding wallet sent 25 ETH to the first address and 23.8 ETH to the second. Both addresses then used the LI.FI router with Layerswap. LI.FI's completed-route records link the Ethereum sends to the Arbitrum receipts. Each Arbitrum address then sent its exact USDC receipt amount to Hyperliquid's deposit contract. Hyperliquid's account records identify the same deposit hashes and the spot trades that followed.Ethereum inputArbitrum USDC receivedHyperliquid deposit25 ETH via LI.FI51,378.430969 USDCSame 51,378.430969 USDC23.8 ETH via LI.FI48,985.187209 USDCSame 48,985.187209 USDCThe accounts bought 91.96 and 87.59 XMR1, respectively, before spot fees. XMR1 is a Hyperliquid token associated with Monero exposure. The verified route ends at the spot fills, with any redemption or withdrawal on Monero still unverified. Hyperliquid public API.Three additional bridge settlementsAll three transfers settled to the same collector address on their destination networks. The Ethereum and Arbitrum addresses have the same hexadecimal value. Each row links the transaction that started the transfer to the one that delivered the ETH.Route and source transactionETH received and destination transactionRecipientdeBridge · Ethereum → Arbitrum · Source0.009992001600000002 ETH · 10 Nov, 19:06:00 UTC · Arbitrum payout0x2846e69d3298e99eddf2fd8116e952844da11fdedeBridge · Arbitrum → Ethereum · Source2.997600480000000002 ETH · 10 Nov, 19:07:59 UTC · Ethereum payout0x2846e69d3298e99eddf2fd8116e952844da11fdeRelay · Arbitrum → Ethereum · Source0.205660219009733071 ETH · 10 Nov, 19:52:35 UTC · Ethereum payout0x2846e69d3298e99eddf2fd8116e952844da11fdeThe deBridge order IDs match the source and destination event logs. Both destination contracts forwarded ETH to the collector in internal calls. The Relay request matches both hashes and the same request data, and the Ethereum transaction paid the collector directly. These receipts establish movement of existing funds across chains.Where the swap’s WETH came fromThe 3.197251591561056299 ETH credit came from converting 3.199811440713627200 WETH taken from a separate Arbitrum victim wallet that Bitquery identified in the Across domain hijack. The collector held zero WETH at the end of the block before the victim transfer, held exactly the amount received through the block before the conversion, and returned to zero after the conversion. The ETH amount is the gross credit before gas. Incident research · Conversion receipt.Event (UTC, 10 Nov)Confirmed movementReceipt17:04:47 · Ethereum fundingThe victim wallet 0xbc7a2346a146188bf0049b3ffe4f1fc6f9a9d276 sent 5 ETH to a contract that holds funds for a later step.5 ETH funding transaction17:04:59 · Ethereum depositThe funding contract released the same 5 ETH using the same funding identifier. An execution contract wrapped the ETH and sent all 5 WETH to the Across SpokePool.Ethereum deposit17:05:02 · Earlier bridge payout0x7fb0be7fcce8cb60a20f050771b53134148dac10 paid 4.999764300892033999 WETH to the victim. The token transfer identifies the wallet that actually received the payout.Payout19:02:57 · Victim funds split0xbc7a2346a146188bf0049b3ffe4f1fc6f9a9d276 sent 3.199811440713627200 WETH to the collector and 0.799952860178406799 WETH to the fee recipient. Together these transfers account for the victim’s entire pre-transfer balance of 3.999764300892033999 WETH.Victim transferThe victim had 30.919486837431786978 ETH just before the funding transfer. Its indexed Ethereum history includes two large credits from 0x1d43041cbc400ce74e54a3abf4ea93dc5fb19cf9 on July 20, 2023, totaling 112.5 ETH. Those credits establish an earlier funding source. Once ETH enters a wallet balance, the chain records what the wallet spends without assigning that spend to a particular earlier credit. 112 ETH · 0.5 ETH.The Ethereum deposit and Arbitrum fill share the same Across deposit ID. Their chain IDs, depositor, token addresses and amounts agree. The Across status API returns both transaction hashes for that ID. The bridge funded the victim before the incident. The later ETH conversion traces the collector’s share of the loss, which is already counted in WETH. Across status record.How much of the first Arbitrum receipt was spent?The collector's ETH balance was zero immediately before the first payout. Before the next inflow, two approval transactions consumed 0.000003556878 ETH from that first receipt. The WETH conversion above credited 3.197251591561056299 ETH and pooled it with the remaining ETH. Arbitrum wallet history, swap and internal transfer.Arbitrum checkpointBlockETH balanceBefore first payout5230664300After first payout5230664310.009992001600000002After the two approvals5230665720.009988444722000002After the swap and its gas charge5230667253.207234052203056301Before deBridge send5230668613.207231896571936301After deBridge send5230668620.206076008898686789Before Relay send5230761860.206066984696066789After Relay send5230761870.000285059834944066The twelve transaction receipts account for 0.000027314746100000 ETH in gas, including two reverted transactions. The successful deBridge and Relay sends carried 3.001150300868641512 ETH and 0.205780917711370723 ETH on Arbitrum. Those are the native values attached on the source chain. The payout table above shows what arrived on Ethereum.Even if the first receipt covered every gas charge and the entire ending balance, at least 0.009679627018955936 ETH from it had to enter the two bridge sends combined. The upper bound is 0.009988444722000002 ETH, the amount left from the first receipt after the two approvals. The later swap supplied enough ETH for either bridge send individually, so the ledger cannot tell which send used the first receipt or how much each used. The bounds use the collector's native ETH balance and exclude separate token movements.Did the victim receive compensation?Across committed to making affected users whole. A payment can be counted when a successful transaction credits an identified victim and the payer or payment batch is independently attributable to Across. The official updates reviewed by the cutoff supplied no payer or batch identifier. A fresh check of the main victim’s indexed Ethereum transactions, internal transfers and token transfers did not show a newer payout candidate. This check covers one victim address and the public records available for it. Across announcement.Record examinedWhat the record showsCompensation status11 Nov, 17:49:35 UTC, 40,659.841619 USDTThe USDT0 adapter released genuine Ethereum USDT. LayerZero maps the release to a successful X Layer transaction initiated by the same victim address at 15:18:39 UTC.Classified as the destination leg of a self-initiated bridge transfer. Upstream funding is unverified. Bridge message, receipt11 Nov, 17:50:23 UTC, same amount shown by a token indexNo matching transfer from the genuine USDT contract in the checked receiptExcluded from payment counts. Receipt11 Nov, 17:50:23 UTC, zero-value USDT entryGenuine contract log shows a value of zeroNo value transferred. Receipt11 Nov, 17:54–17:55 UTCVictim exchanged USDT for USDC and used USDC in an Aave repaymentThese transactions establish the victim's subsequent use of funds. The funding purpose remains open. Swap, Aave repaymentThe X Layer receipts explain how the wallet assembled the transfer. Before the two swaps it held 12,705.278479 USDT0. At 15:17:23 UTC the wallet swapped USDC for 16,061.785784 USDT0. At 15:17:54 UTC it swapped USDG for 11,892.777356 USDT0. The three amounts add up to 40,659.841619 USDT0, which the wallet then bridged to Ethereum. A historical balance check traced most of that funding to four Uniswap v4 liquidity removals initiated by the victim address on November 10. A liquidity position holds tokens in a trading pool. Removing liquidity returns tokens to the position holder. In each receipt the PoolManager records a negative liquidity change and sends assets to the victim address. Uniswap X Layer deployments. USDC swap, USDG swap.10 Nov UTCAmounts returned to the victim on X LayerEvidence20:24:585,186.401209 USDT0 and 10,443.039964 USDCPosition withdrawal20:25:223,091.935957 USDT0 and 10,940.097312 USDGPosition withdrawal20:26:373,903.503505 USDT0 and 5,447.652268 USDCPosition withdrawal20:27:39285.654001 USDT0 and 707.894753 USDGPosition withdrawalThe withdrawals account for 12,467.494672 USDT0, 15,890.692232 USDC and 11,647.992065 USDG before the swaps. The wallet already held smaller balances in all three tokens. The records establish the immediate sources of the bridged funds. An authenticated Across payer or batch hash would be needed to identify separate reimbursements. A subsequent Hyperliquid withdrawal would need its own receipt and, for a claim about native XMR, a matching Monero-side record.Evidence appendixRoleAddressEthereum victim0x42e7ab48d5ae0ed6941a89492d1c5dfb06b8483cCollector0x2846e69d3298e99eddf2fd8116e952844da11fdeFee recipient0x0c7c656126aa62625fdd8051eb69dc14aee8d37bETH splitter0x38d7e8b3c9561caf096c06c62c7561f8ab6e514caWETH token contract0x4d5f47fa6a74757f35c14fd3a6ef8e3c9bc514e8Bitcoin destination3EQ9Rqrtvco4nKmskv2jQRXvWKkpUGfAQsInitial SOL recipientG47n6dbUor1WFweLvKPrUi5beW4yjRoFG3cJZU6a4uSaSOL intermediate wallet2K7fueB3tqYBb5Z2Ubnnpf2rF3sJr1fJDKXtsocTAWmkFinal observed SOL address5HQZd9ovzAF1TLnHRAq1zcSnXC9HAp3EwhoxMHvo8rxBHyperliquid account 10x09360fe2e18fdfa49beb7592b9f24f94c5465533Hyperliquid account 20xf229f808fe21911f8bcc24ebb30a85bd2e4c00f0Chainflip funding wallet0x0f67a21780699bb5c5e6b5f986c0bab26bfffe5cHyperliquid branch funding wallet0xf10a482fbc02195f2dafca5d9dfd19c871b0f4a5First Ethereum side wallet0xa490cde73adcd40475025ee8710f3a5ab7393194Second Ethereum side wallet0xbca05d20dbb271fd607e69fdc8d955be3bfc8120Ethereum USDT0 adapter0x6c96de32cea08842dcc4058c14d3aaad7fa41deeReproduction. Ethereum: inspect successful receipts for the exact aWETH contract and standard Transfer event, then sum base units by recipient. For native ETH moved inside a contract call, inspect execution traces. Bitcoin: compare the source hash embedded in the data output with the Ethereum input and read output 0 separately. Solana: inspect parsed system transfer instructions. Hyperliquid: query userNonFundingLedgerUpdates and userFillsByTime for the two accounts and match the deposits with the subsequent spot fills. The dollar figure is Bitquery's historical estimate. Values from successive stages describe movements of funds and should never be summed as new victim losses.

On November 9, 2026, five successful calls to Ankr’s Ethereum bridge released five token positions to one recipient within a window of two minutes and 24 seconds. The subsequent record describes conversion through MetaMask Swaps, an ETH transfer to a consolidation address, and deposits to an address labeled Tornado.Cash Router.The sequence is more specific than a headline loss estimate. It identifies the bridge, the signer, the beneficiary and the onward route. It does not establish the precise authorization failure, identify the people controlling the addresses, or link mixer withdrawals to an eventual recipient. Several quantities in the onward narrative remain unverified and should not be treated as confirmed loss or recovery figures.This analysis covers the November Ethereum incident, not the separate August ankrFLOW/Flow case. All times below are UTC. The underlying report is dated November 11, 2026, with data retrieved at approximately 01:42–01:44 UTC.Five releases in a narrow windowThe report identifies the relayer as the signer of five zero-native-value calls to the bridge between 08:09:35 and 08:11:59. Zero native value describes the calls’ ETH value; it does not mean no token value left the bridge. Each call released one token position to the same recipient.The release register records:08:09:35, block 26376043: 82.911105628282457579 ankrETH. The source decodes log 867 as a Transfer from the bridge to the recipient, with a raw value of 82911105628282457579 wei.08:09:47, block 26376044: 7,982,766.478492331 ANKR.08:09:59, block 26376045: 515,206.25574139773 aMATICc.08:11:23, block 26376052: 5,372.248765839372 aMATICb.08:11:59, block 26376055: 0.819623228838796 fETH.The final four quantities are transfer-screen values at display precision. Their signer, called contract, blocks and times are taken from the relayer’s transaction list. These asset amounts stay in their own units: adding ANKR, ankrETH and the other tokens would not produce a meaningful aggregate.Figure 1. Five bridge releases, November 9, 2026. The timeline shows recorded UTC timestamps rather than a valuation comparison. Source: PDF pp. 4–5.Conversion did not move every assetThe source describes swaps beginning at 09:12:11, after the last bridge release. It records all the received ANKR and most of the received ankrETH being routed through MetaMask Swaps. The stated ankrETH swap total is 77.911105628282457579 across 26 transfers, but that amount is explicitly unverified in the source. Individual ANKR swap quantities are also qualified as unverified transfer-screen readings.The distinction matters: this supports a described conversion route, not an independently established exchange cash-out. The swap router is not a custodial exchange deposit address. The report also records an mUSD round trip rather than a net movement; counting both sides as fresh proceeds would overstate value.The aMATICc, aMATICb and fETH positions are described as unmoved after receipt. A later balance read also lists remaining ankrETH and POL. The relevant balances are qualified in the source, and the read returned no block height. They should not be presented as guaranteed recoverable assets or as live balances after the report’s retrieval time.The consolidation address introduces an attribution boundaryAt 11:36:59, the report records a native ETH transfer from the recipient to a consolidation address. The narrative quantity is 104.715783419546018142 ETH, explicitly unverified against the retained amount evidence. The same address received value from two other senders before depositing to the mixer-labeled endpoint.Between 11:39:59 and 11:44:35, the report lists 12 deposits with denominations of 100, 10, 1 and 0.1 ETH. Its stated aggregate is 113.7 ETH, also unverified. That total is the hub’s described deposit volume, not an amount attributable solely to this incident. It includes value from other senders. The recipient-to-hub amount, the hub’s deposits and earlier token releases must not be added as separate losses.Figure 2. Route described in the source: bridge → recipient → consolidation hub → mixer-labeled endpoint. Equal-width arrows show sequence, not proportional value. The dashed boundary marks where onward tracing is not established. Source: PDF pp. 3–7, 9–10, 14–15.No exchange-deposit leg is observed within the report’s scope through November 11. That is a scope-limited finding, not proof that a later exchange deposit cannot occur. Movement onward from the mixer is not established, and possible exit addresses cannot be treated as deterministic matches.Noise is not another loss or another operatorThe recipient’s transfer screen contains repeated “ETH” events and look-alike counterparties. The report distinguishes those events from the native ledger, which records one native outbound debit from the recipient in the relevant sequence. It classifies additional rows, forged token symbols and small look-alike transfers as suspected address poisoning or spam rather than additional economic outflows.This prevents two errors: multiplying the incident amount by repeated screen rows, and treating shared poisoning senders as evidence of common ownership. The report retains these records but does not use them to establish control of the incident addresses. Funding relationships alone likewise do not identify an individual or prove common control.What the evidence leaves openThe bridge’s withdrawal authorization mechanism remains undetermined. The available evidence does not establish how the relevant function and additional event authorized the releases. Proposed explanations remain unconfirmed; no specific root cause is established in this analysis.The identities and attribution status of the relayer and recipient remain unverified. The mixer designation is a source label, not an independently verified identity or sanctions determination. No conclusion about address ownership or sanctions status follows from that label alone.Response priorities supported by the traceThe source identifies three practical investigative directions. First, preserve swap-order metadata for the recipient’s MetaMask Swaps activity. That could provide an off-chain lead, subject to the provider’s records and the appropriate process. Second, obtain first-party decoding from the bridge operator to establish how the releases were authorized. Third, examine the sources funding the operating addresses and consolidation hub.The report also recommends assessing whether issuer controls could apply to unmoved token positions. It does not establish that such controls exist or guarantee recovery. These are investigative recommendations, not actions already taken by ChainBounty.Figure 3. Conclusion: a recorded release sequence and described onward route, with mechanism, identity and mixer exits unresolved. Source: PDF pp. 14–15.The useful outcome is a bounded case map: five bridge releases, subsequent asset conversion, a consolidation route and a mixer boundary. The next evidentiary step is to clarify authorization and funding origin without turning uncertain amounts, poisoning artifacts or address proximity into stronger claims than the record supports.Address and transaction keyBridge: 0xC437DF90B37C1dB6657339E31BfE54627f0e7181Relayer: 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6Consolidation hub: 0x92b2a947551d780f94dda2ef7ec566accdbd796dFirst bridge release: transaction. Recipient-to-hub leg: transaction. These links identify the transaction records cited in the underlying report; the evidence qualifications above continue to apply.Source and limitations noteSource: investigation report dated November 11, 2026, 30 pages. The report covers 108 traced movements across 20 addresses and $665,062.85 in movements that could be priced. This is aggregate priced movement volume, not incident loss. The reviewed query spans October 10–November 11; the incident narrative focuses on November 9–11.Several quantities remain unverified. Thirteen transaction hashes listed in the report’s Fund-Flow Summary are not supported by the retained transaction evidence. This limitation does not establish that those transactions do not exist, but they cannot be treated as verified anchors on that basis. The described route does not, by itself, verify each amount.This article presents the underlying report’s findings and qualifications. It does not establish a complete loss or recovery total, the authorization failure, address ownership, sanctions status or the destination of mixer withdrawals.

After a security incident affecting some Keplr wallets created through Google or Apple sign-in, Web3Auth moved funds to recovery addresses it later published. We traced representative transfers into two of those addresses and looked for payments back to users. We also followed a separate route from a publicly reported wallet through Osmosis and Axelar to two Ethereum payouts.Incident records begin on 6 November. The recovery-account balances below were read at approximately 06:49 UTC on 9 November. All transaction times use UTC.What the records distinguishCategoryEvidence from this reviewActual theftKeplr reported unauthorized transactions. We verified a separate route associated with a public loss report. Its relationship to this incident and the sender’s consent remain unverified, so the route is excluded from any confirmed theft total.Funds securedWe verified transfers into the two addresses named by Web3Auth and Keplr. Their native bank balances were 549,460.375955 ATOM and 2,553,515.123670 OSMO. Other token balances and Cosmos Hub staking-share tokens are separate.Funds returnedNo user payout was verified from the two disclosed addresses in the records checked. The amount returned through any other channel remains unknown.Keplr identified unauthorized activity affecting some accounts created through social login. Web3Auth paused the embedded wallet service that supports sign-in for third-party apps. The companies later published matching recovery addresses. On-chain transfers show where funds moved, while the companies’ notices identify the purpose of the recovery destinations. Keplr’s initial notice · Web3Auth service notice · Web3Auth recovery list · Keplr’s matching list.A reported wallet moved funds before the recovery samplesA public loss report named a Cosmos Hub address and an Osmosis address. We found the same signing public key in transactions on both chains. On 6 November at 14:12:35, the Cosmos Hub address sent 3,755 ATOM over IBC, the protocol the two chains use to pass transfer messages. Osmosis recorded the matching packet 12 seconds later, crediting a representation of the ATOM to the other named address. This was the same transfer recorded on two chains. Public report and original research lead · Cosmos Hub send · Osmosis receipt.The Osmosis wallet swapped several assets before sending two batches of bridged wrapped ether (WETH). Wrapped ether is a token that represents ether. Axelar routes a representation of it between chains. The 3,755 ATOM was one input to that wallet, which also received other assets. Axelar recorded both IBC packets, deducted fees and submitted matching contract calls to Ethereum. The Ethereum receipts confirm both executions. Internal calls in the two Ethereum transactions show the wrapped tokens converting to native ETH and reaching the same address. Axelar deducted a combined 0.000357328849747426 WETH in fees from the 6.1 WETH sent.Read Figure 1 from top to bottom. The arrows follow the matched records from Cosmos Hub to the Osmosis wallet and then the two onward packets.Figure 1. Selected on-chain route from the public loss report. Solid arrows represent observed transfers or matched bridge steps. The diagram is schematic and omits the other assets that entered the Osmosis wallet. The links below identify the source and destination records.The two payouts reached 0x531f1d541fec4a6a6439e7651620f66f8d854c1d. The recipient made an onward transfer of 0.39247296 ETH between the two payouts. It also received funds in other transactions. The records establish the two payouts and the separate onward movement. The exact source of the onward payment and the recipient’s role remain open. Onward transaction.6 Nov UTCMatched bridge records14:26:34 → 14:28:235.4 bridged WETH sent. 5.399862946303386963 ETH received. Osmosis send · Axelar packet 1731438 · Ethereum payout.14:41:02 → 14:41:590.7 bridged WETH sent. 0.699779724846865611 ETH received. Osmosis send · Axelar packet 1731444 · Ethereum payout.What reached the published recovery addressesAn early Osmosis sweep moved liquid assetsOn 6 November at 23:10:56, a wallet sent nine token denominations to the address later named by Web3Auth, including 1.313132 OSMO. Bitquery initially attributed the larger sweep to an attacker and revised its classification after the recovery disclosures. Its dollar estimate covers a wider set of chains and assets than the native balances in this report. Nine-denomination transfer · Bitquery’s 8 November correction.Cosmos Hub moved claims on staked ATOMIn a bundle confirmed on 7 November at 09:57:04, one delegator changed where its staking rewards would go. It then turned 3,012.591649 staked ATOM into a transferable claim and sent the resulting share token to the recovery wallet. The record identifies the exact share-token denomination and shows it arriving there. A share token represents an existing stake. Moving it transfers the claim without first waiting to unstake, and the share token remains separate from liquid ATOM. Across the bundle, 13 tokenization messages specified 16,062.223948 ATOM of stake. Cosmos Hub recovery bundle.Osmosis was still receiving staking rewards on 9 NovemberAt 06:33:58, an Osmosis bundle changed reward withdrawal addresses and triggered three payouts into the disclosed recovery account. The recorded amounts add up to 3.219209 OSMO. The network’s distribution module sent them to the recovery account. Those credits increased the recovery balance, and a separate transfer would be needed to return that value to users. Osmosis reward bundle.Checking for payments back to usersChainRecovery account snapshotCosmos Hub549,460.375955 ATOM native balance at block 33,794,930. Account sequence 0. The indexed sender searches returned zero matches.Osmosis2,553,515.123670 OSMO native balance at block 74,576,112. Account sequence 0. The indexed sender searches returned zero matches.Account sequence counts how many times a standard account has used its transaction counter. Both recovery accounts were at zero. Searches for the accounts as message senders, transfer senders, coin spenders and IBC senders returned no matches. This is a scoped check of two addresses and the available indexes. It cannot establish whether another account or an off-chain process made a payment to a user. A verified return would require a payout record tied to the original affected wallet or an authenticated replacement destination.The return status for the two checked recovery addresses is therefore no user payout verified. The strongest finding on the separate reported-loss route is a completed delivery of 6.099642671150252574 ETH to one recipient. Confirming it as theft attributable to this incident would require additional evidence linking that route to a compromised account and establishing that the transfers were unauthorized.Evidence appendixCosmos Hub published recovery addresscosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwuOsmosis published recovery addressosmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcwCosmos Hub wallet named in the public reportcosmos1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jv8yhqmOsmosis wallet named in the public reportosmo1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jyuh8kfThe selected transaction records below preserve the full identifiers for independent verification.Cosmos Hub · Reported-wallet IBC send2026-11-06T14:12:35Z · Block 33754215 · 3755 ATOMA296459EA166BF6E6A8262945C2481CF735F061897A74C76255ABDAF099D5A27Osmosis · Matched IBC receipt2026-11-06T14:12:47Z · Block 74296875 · 3755 ATOM in IBC representation571D058FCB313EB453E2913A0CFF940D530A608DB98DC6F83BDECFABE38C5162Osmosis · Reported wallet bridged WETH send2026-11-06T14:26:34Z · Block 74297865 · 5400000000000000000 base unitsC574EFB8370BC41BD25D3DE879EBFE113820E1BF62F15DE44ADEA8DD9CC00291Axelar · Matched packet and Ethereum call2026-11-06T14:26:35Z · Block 37354683 · 5399862946303386963 base units after fee1C6E0D259923CA578FB6DBB6BAFA821DF2FE27167EE7DAF966D960B1DA2609DBEthereum · Final native payout2026-11-06T14:28:23+00:00 · Block 26356407 · 5399862946303386963 wei0x5435c0c2cbcf20f1d4e786d2f0e153e206093459bc2b0a11d509b366535bdef6Ethereum · Separate onward movement2026-11-06T14:30:23+00:00 · Block 26356417 · 392472960000000000 wei0x7ce42ab772c8bf6952d7f719b9e0e3d244317375c18a78e8c013273057d484d2Osmosis · Reported wallet bridged WETH send2026-11-06T14:41:02Z · Block 74298910 · 700000000000000000 base units4959DF31DF3FCAB57CDD9EAE6BA652C3395E509D82BF46AC95046FC62062FF55Axelar · Matched packet and Ethereum call2026-11-06T14:41:03Z · Block 37355165 · 699779724846865611 base units after feeA71C80E464481F06A5696AB715B80F5560D22D88F8392B8D6BD064C9BAD913E8Ethereum · Final native payout2026-11-06T14:41:59+00:00 · Block 26356475 · 699779724846865611 wei0xf1fcfe3291cceef96a326dd4a1257846ad711423253529e2c23cd44ad52821e2Osmosis · Nine-denomination recovery send2026-11-06T23:10:56Z · Block 74335672 · 1.313132 OSMO and eight other denominationsD1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9Cosmos Hub · Recovery stake-tokenization bundle2026-11-07T09:57:04Z · Block 33766653 · 16062.223948 ATOM specified in 13 tokenization messages811DDF1FAE1551EA6F26317D3B7EAFF45912C780661BFE9F322C815CC8228DBAOsmosis · Recovery reward credit2026-11-09T06:33:58Z · Block 74574971 · 3.219209 OSMOE434BBD8C9BD680B964FCF3E6E939B5B2424918D4D4F097DBA8EF73999DAFD35State and transactions were checked against public Cosmos REST responses, Axelar packet events and message records, Ethereum JSON-RPC receipts and Blockscout internal-call records. Native balances use six decimal places. The two bridged WETH amounts and ETH payouts use 18. The bank balances are point-in-time holdings and exclude the value of staking claims, other denominations and other chains.