Keplr's Cosmos Collectors Were Named as Recovery Wallets. What the Ledger Actually Shows

BlockintAI · 2026-11-09T01:10:12.130Z

Keplr reported unauthorized transactions affecting some accounts created with Google or Apple login on November 6–7, 2026. Researchers described receiving accounts across Cosmos chains as attacker collectors; Web3Auth and Keplr subsequently identified those exact destinations as recovery wallets. Transfers into the listed accounts cannot therefore be treated as an independently verified tally of thefts.

Keplr warned users at 10:38:41 PM CT on November 6 (04:38:41 UTC on November 7) that some Google or Apple login accounts had seen unauthorized transactions, and it paused those logins. About seven hours earlier, at 3:13:33 PM CT, Web3Auth had reported a security issue affecting services used by some third parties and said it had paused its embedded wallet service.

A public Bitquery investigation, with a transaction cutoff of 9:38 AM CST on November 7 (15:38 UTC), reported 44,041 deduplicated sending accounts across seven chains and 7,603 Injective sending accounts with overlap. It estimated only about 690 additional Injective accounts from a sample, not 7,603 additional unique victims. Its $6.01 million was a receiving-balance valuation using 9:27 AM CST prices, not our independently verified net loss. The later official recovery disclosures materially change the interpretation of those balances and sender counts.

Public bank/auth responses captured at about 7:16 AM CST on November 8 reported sequence 0 for the eleven Cosmos-family destinations below and 81,006.205765 USDC on Noble. The later independent checks recorded below returned the same balances. Sequence and an absent public key describe returned account state; they are not an exhaustive test of every possible outgoing value movement. We did not re-tally the sending accounts, classify each movement as theft versus recovery, or rebuild the dollar snapshot.

Times are in America/Chicago, CST (UTC−6) for all November 6–8 timestamps in this article.

Cover illustration: conceptual incoming flows, not a measured transfer graph, wallet count or proof of theft. The depicted destination set was subsequently identified by the companies as recovery wallets.

Key facts

What Keplr and Web3Auth said

The first notices are in the table above. The next morning, Josh Lee wrote on X that this "was not a hack of Keplr's code" and that "the incident originated at Web3Auth, a provider Keplr uses." He estimated that about 20% of Google or Apple login accounts were affected and that only a fraction of that group had actually been exploited.

On November 7 at 11:06:35 AM CT, Web3Auth said that, with partners, it had begun "whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker." Eleven minutes later Keplr said a Web3Auth infrastructure vulnerability had led to a "private key breach" for some Google or Apple login users, that Keplr was assisting Web3Auth "to secure and protect assets from affected users," and that some of those accounts "may already show a reduced or empty balance as a result of these mitigation efforts."

Early on November 8, at 12:23:55 AM CT, Web3Auth posted a verified list of "recovery addresses used to secure affected assets, not attacker-controlled wallets." The list included the eight collector addresses Bitquery had published, plus same-key addresses on Axelar, Saga and Agoric and an EVM address, 0x413e4F4De7E5FF010913488F781E679e76f706dA. Keplr repeated that list at 12:31:35 AM CT.

The collector set

The ten non-Injective Cosmos-family destinations below decode to the same 20-byte address payload, eaf9d096c99af44392cc9c6b1f67d2888e04a6f1. Equal payloads do not by themselves establish a signing key or controller. Injective's inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g decodes to 0xf836ddf3029d0669d256c46ae70c0dcdfcfcac29; that is an address encoding, not proof of Ethereum activity. The recovery classification here is specifically Web3Auth's, repeated by Keplr. Mintscan application shells supplied no address labels. Literal searches in the November 8 Treasury snapshot returned no matches; that establishes neither ownership nor safety.

Bank-module balances and account sequences, captured through public cosmos.directory REST endpoints at about 7:16 AM CST on November 8. Independent rechecks between 7:27:17 AM CST and 7:28:06 AM CST returned identical balances for all eleven accounts. Pages were read sequentially per chain, not pinned to one common block height:

Independent rechecks returned sequence 0 and null public keys on all eleven listed Cosmos-family accounts, with bank balances unchanged from the earlier capture. Ten indexed message-sender queries returned zero matches; Osmosis returned an indexing-disabled error, not zero. These are bounded account/query observations, not an exhaustive proof that no value can have left. They do not establish controller identity or malicious intent.

On Cosmos Hub, the 22,780 validator share-token denominations contain a raw integer sum of 1,955,874,075,769. Dividing that sum by one million gives 1,955,874.075769, but adding heterogeneous share denominations does not produce an ATOM balance. Bitquery's 1.96 million ATOM estimate uses validator exchange rates; we did not independently reconstruct the historical conversion. Tokenization can transfer a staked claim without first unbonding, but does not necessarily make it immediately redeemable or sold. Bank balances do not establish USDC blacklist status, and no issuer-freeze conclusion is drawn here.

What Bitquery measured

Bitquery's investigation is a published research page. The wallet counts and dollar snapshot are theirs, cut off at 9:38 AM CT on November 7, with prices from 9:27 AM CT. They wrote that the drain ran about 18 hours; that the typical wallet lost $1.34 and 88% lost under $100; that the largest single loss was about $325,000; that 46% of drained wallets on the seven same-key chains were hit on two or more chains; that 86% were emptied after Keplr's warning; that from 3:57 AM CT on November 7 a gas wallet paid for bundles of up to six Cosmos Hub wallets; and that sweeps on seven chains stopped within 19 seconds around 4:34 AM CT, while Cosmos Hub was still running at their cutoff.

They also wrote that neither collector had sent a transaction and that if Keplr or Web3Auth later said these collectors were safe addresses, they would correct the record. The companies made that statement the following night. These are Bitquery's historical research claims, not independently reconciled theft or victim totals. Its method counts sending accounts, while chain records do not reveal social-login creation or consent. The Injective population overlaps: its sample-based estimate of roughly 690 additional accounts yields about 44,700 combined, not 51,644 unique victims. Unpriced assets and a suspected spam token were excluded from its valuation. The official recovery disclosures prevent equating all these transfers with criminal loss.

A victim report, and what the ledger shows

A victim report filed on BlockintAI at 9:21:39 AM CT on November 6 (c773a8c2-9528-4fdd-a7de-1d2ec47aa769) is titled "Keplr wallet drain," lists $5,000 lost, and names osmo1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jyuh8kf and cosmos1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jv8yhqm. The description says, "Keplr wallet completely drained on the cosmos and osmosis and injective chains." The named addresses decode to the same 20-byte account payload. Successful transactions we independently checked expose the same signing public key across those two accounts and the Injective sender discussed below; this does not establish the submitter's identity, consent or loss.

Our on-chain review of those two addresses — and of the transaction-linked Injective sender inj1ltf9lqcdyfqwm5xpnjyz9y0vh574w23jxwnnjr — identified activity that differs from Bitquery's stated first sweep at 2:52 PM CT on November 6 (20:52 UTC) and did not go to the published collectors.

The first outbound we read was at 8:10:55 AM CT on November 6 (14:10:55 UTC), when the Osmosis address sent 0.5 OSMO to osmo1t3pxdcaexu5jtj4n5v08pjqw7kwqqyc8dsg7d8. At 8:12:35 AM CT the Cosmos Hub address moved 3,755 ATOM to the Osmosis address sharing its signing public key over IBC. At 8:33:20 AM CT the Injective sender moved 83.4 INJ to that same Osmosis address; it has signed only that transaction. In between, the Osmosis wallet signed a burst of swaps that routed ATOM, TIA, AKT, OSMO, INJ and other tokens toward weth-wei (IBC denom trace: transfer/channel-208, base denom weth-wei). At 8:26:34 AM CT and 8:41:02 AM CT it transferred 5,400,000,000,000,000,000 and 700,000,000,000,000,000 weth-wei base units on Osmosis channel-208 to axelar1dv4u5k73pzqrxlzujxg3qp8kvc3pje7jtdvu72npnt5zhq05ejcsn5qme5. Both memos name destination_chain as ethereum and destination_address as 0xce16F69375520ab01377ce7B88f5BA8C48F8D666, which the saved Etherscan page identifies as Squid: Router (the live page was blocked during this review).

That morning burst finished before the victim report was created at 9:21:39 AM CT, and it was more than six hours before Bitquery's 2:52 PM CT first-sweep time. Later that night, at 10:19:24 PM CT and 10:20:00 PM CT — about twenty minutes before Keplr's warning — the same wallets sent leftover 25.78 OSMO to osmo1msjpr3kdzymxrsfce3tlhzhjujxkna7qse2qjm and 3.14 ATOM to cosmos1msjpr3kdzymxrsfce3tlhzhjujxkna7qczesyf, a matching-address-payload pair outside the published collector list. As of our check the two named addresses still held dust: 0.053159 ATOM and 0.632393 OSMO, plus leftover factory and pool-share tokens on Osmosis.

We did not independently price those flows against the report's $5,000 figure. The captured successful direct sends do not identify a transfer to the published collectors. This is a bounded route/timing comparison, not a finding that the community report is false or belongs to the same incident. The IBC memos name a routing-contract destination; they do not identify the final beneficiary or prove completion of an Ethereum payout. Transaction signatures do not establish the account holder's consent. Two later pool-exit attempts returned code 7 and are not counted as successful transfers.

The gas wallet and two payouts

Bitquery described a separate Cosmos Hub gas wallet that signed bundled stake-tokenization transactions, and two busy wallets that sent it ATOM on November 7. We read those three transfers on the Cosmos Hub REST API. Each paid a flat 0.02 ATOM fee (20,000 uatom).

Those amounts match Bitquery's rounded figures of 73.29, 45.70 and 109.62 ATOM. As of about 7:16 AM CT on November 8, the gas wallet had sequence 2,520 — consistent with Bitquery's reported count, but not an independently enumerated transaction history — and held 37.365565 ATOM. Sequence is an account nonce, not a separately verified count of outgoing transfers. The first payout wallet had sequence 1,216,346 and 58,977.681120 ATOM; the second had sequence 59,925 and 8,400.992949 ATOM. No named exchange or controller was established for either payout wallet in the readable sources checked. A high account sequence does not establish an exchange identity. Web3Auth's November 8 recovery list does not include these three addresses.

Bitquery's address record also prints the hash D1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9. An independent Cosmos Hub REST lookup returned "tx not found" for that hash. The same hash on Osmosis, at 5:10:56 PM CT on November 6 (23:10:56 UTC, height 74,335,672), is a single MsgSend from osmo120tsv7fww4uedse4zutac5dll5uv9qklcy4k7g to the Osmosis collector osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw that moves nine token types in one step, including 1.313132 OSMO. That matches Bitquery's description of an Osmosis transfer a victim posted — one transfer that emptied a wallet of nine kinds of tokens — rather than the 73.29 ATOM Cosmos Hub gas top-up, which is the separate hash above.

Keplr's later guidance for anyone who created an account with Google or Apple login is to send no new funds to that account, move any remaining liquid assets to a wallet created with a recovery phrase or a hardware wallet, trust updates only from Keplr's and Web3Auth's official channels, and ignore messages that offer recovery.

Sources

• Keplr, X, November 6–8, 2026: first notice, November 7 update, recovery-address list
• Web3Auth, X, November 6–8, 2026: first notice, November 7 updates, recovery-address thread
• Web3Auth status page, Login Service maintenance
• Josh Lee, X post, November 7, 2026
• Bitquery, Keplr Wallet Hack: $6.0M Taken From 44,000+ Wallets
• Public chain REST via cosmos.directory (Cosmos Hub, Osmosis, Injective, Akash, Celestia, Noble, dYdX, Babylon, Axelar, Saga, Agoric), read about 7:16 AM CT on November 8, 2026
• Osmosis LCD transaction D1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9; Osmosis IBC denom traces for weth-wei, uatom, uusdc, utia, uakt and inj
• Etherscan address pages and transaction lists for 0xf836ddf3029d0669d256c46ae70c0dcdfcfcac29, 0x413e4F4De7E5FF010913488F781E679e76f706dA, and 0xce16F69375520ab01377ce7B88f5BA8C48F8D666
• OFAC SDN list download, searched November 8, 2026
• BlockintAI victim report c773a8c2-9528-4fdd-a7de-1d2ec47aa769

Lost funds from a drained wallet, or believe you were affected by this incident? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file.