Galactic Tracker

Victim sends

42,363

Distinct senders

24,660

Transactions

21,343

ATOM swept (MsgSend)

349,966

ATOM now in drain wallet

532,933

Denoms received

23,917

Largest single send

20,794 ATOM

First / latest send

Nov 6 20:52 UTC / Nov 7 15:33 UTC — Cosmos Hub quiet since

Cosmos Hub block scan, Nov 7 15:35 UTC. Up to 6 victims bundled per transaction.

Osmosis — sends / senders

29,280 / 29,248

Osmosis — balance now

1,788,487.64 OSMO

Injective — successful sends / senders

7,606 / 7,603

Injective — balance now

67,987.05 INJ

Injective — failed sends

404 (out of gas)

Babylon — sends / senders

749 / 748

Babylon — balance now

1,407,799.79 BBN

IBC hops between drain wallets

None

Full block scans of Osmosis, Injective and Babylon, Nov 7 ~17:00 UTC. Injective amounts verified against the balance to the unit. Only 4 senders kept everything (their sends all failed).

The attacker rehearsed every step before going live — and left a trail on-chain.

• Fee payer: funded by exactly 3 transfers totaling 228.61 ATOM; made 2,520 self-sends of 1 uatom, one per tokenize batch.
• Control wallet: seeded test accounts, ran cross-chain IBC tests, and rehearsed the LSM tokenisation — then the real attack copied the same script.
• The first "drain sends" were rehearsals: 10 × 13,242 uatom at Nov 6 20:52:37 UTC from the 10 addresses seeded at 20:48:47, then the two test wallets forwarded 26,253 uatom each at 21:57:39 UTC. They are not victims.
• One key, 8 chains: the control/test key spans Cosmos Hub, Osmosis, Babylon, Noble, dYdX, Axelar, Saga and Agoric.
• Funding sources: identities unverified — only their attack payments are established (237.07 ATOM total).

Observed on-chain, Cosmos Hub. After 09:00 the drain shifted to tokenising staked ATOM instead of sweeping liquid funds.

99.7% of the LSM tokens in the drain wallet were created during the incident — the attacker tokenised victims' staked ATOM in bulk instead of waiting 21 days to unbond.

• 23,922 LSM sends; 23,747 distinct LSM denoms; ~1.956B share units.
• Record IDs ran 114,786 → 145,076 during the attack (~25,000 records created).
• Largest holdings sit on consecutive records 122,293–122,297 across 3 validators — batch tokenisation, not old victim holdings.
• The drain wallet never delegated or tokenised anything itself — it only received.

Tracing in progress. Outflows from the 4 flagged wallets are being followed now — drain transactions and destination wallets will appear here as they are found.

Per-chain wallet counts overlap — one seed phrase appears on multiple chains. Prices at ATOM $1.39 / INJ $8.24. Totals are community on-chain analysis (Nov 7); no official total exists.

• $0 moved. All 4 drain wallets have sequence 0 — none has ever signed a transaction.
• Circle can freeze ~$188K of Noble USDC in the Osmosis drain wallet.
• Exchanges, bridges and liquid-staking providers asked to flag all 13 wallets.
• Chains asked to freeze the flagged wallets.
• Babylon drain wallet holds 1,407,799.78 BBN.
• Osmosis / Injective / Babylon inflows are being block-scanned now — results land here next.

• Do NOT send new funds to any wallet created with Google or Apple login until Keplr says it is safe.
• Move any remaining liquid assets to a recovery-phrase or hardware-wallet account (Keplr's latest advice, Nov 7).
• Do NOT re-import or recreate a Google/Apple-login Keplr account anywhere.
• Seed-phrase and hardware wallets are safe — move funds there if you can do it from a safe wallet.
• Trust only official Keplr / Web3Auth channels. Ignore every DM offering “recovery” — they are scams.
• Whitehat recovery is real: Web3Auth is moving funds out of vulnerable wallets that were not yet drained, using the same path the attacker used — those transfers look like theft on-chain but are recovery, and the funds are safe. Web3Auth published the verified recovery vault list on Nov 8 06:02 UTC (via Josh Lee) — 12 vaults, on the Check Your Wallet and Recovery Map tabs. Trust only addresses published through official Web3Auth/Keplr channels.
• Check activity read-only in an explorer (links below). Reading never needs a wallet connection or a signature.
• Keplr is building an official checker (Josh Lee, Nov 8 06:04 UTC). This tracker’s Check Your Wallet tab already checks the drain list and flags recovery-vault matches — never use a random “checker” site.

• Find your affected address. Social login is paused, so you cannot open Keplr to copy it. Try these instead: check the Keplr extension's local storage / IndexedDB in your browser's Developer Tools for cosmos1 / osmo1 addresses; check the withdrawal history of any exchange you funded the wallet from — the destination address there is your wallet; or resolve your .cosmos / .stars name if you had one.
• Find the thief's address. Paste your address into Mintscan (links below) and look at recent outgoing transfers — MsgSend or IBC transfers around Nov 6–7 that you did not make. Open the transaction: the recipient address is where your funds went, and the 64-character transaction hash is the proof.
• Follow the money. Check the thief address's own outgoing transactions for IBC hops (e.g. ATOM moved to Osmosis and swapped). If funds land in an address tagged as an exchange deposit wallet, report the transaction hash and attacker address to that exchange's security desk to request a freeze.
• Report it. Send victim address + attacker address + transaction hash + timestamps to Keplr/Web3Auth incident response and to chain-analysis reporting services.
• Never enter a seed phrase or private key on any “wallet checker” or “recovery” site. Checking an address on Mintscan is read-only and safe — it never asks you to connect a wallet or sign anything.

• Over 40,000 AKT taken from his wallet ("You'll see, over 40,000 Akt bro lol" — Nov 7 18:27 UTC). The on-chain total is 40,066.86 AKT.
• "They sent to another AKT address then swapped for Osmo like 1,000 AKT at a time." Verified: the AKT went to akash1w05l… on Nov 1, then by IBC to Osmosis, where it was swapped away.
• He posted his AKT account Nov 7 18:56 UTC: akash1vk6mqt3jaxu4ys9a2849qu2u0k0kt8kuajg5dv — and confirmed the trail: Nov 1 to another AKT account, then to Osmosis, swapped to OSMO, then sent to other Osmo addresses.

• His AKT account is verified and drained: akash1vk6mqt3jaxu4ys9a2849qu2u0k0kt8kuajg5dv (account 92291, seq 470) holds just 0.003 AKT now. He posted it Nov 7 18:56 UTC.
• The theft happened Nov 1, 21:19–21:20 UTC — five days BEFORE the Keplr hack: two sends totaling 40,066.86 AKT to akash1w05lm0ng2y6wfthhwtqsmuc7xx83j7r49406f4. Hashes 5A82C4FC73BE688B… and 5DCDA1DCF643A311…. This is likely a SEPARATE theft, not the Keplr/Web3Auth drain.
• The AKT went to Osmosis by IBC 2 minutes later: Nov 1 21:21:49 UTC, tx CEA57DBAE1A47C21…, 40,066.85 AKT via channel-9 → channel-1 (packet 485820) to osmo1w05lm0ng2y6wfthhwtqsmuc7xx83j7r4q43dxa. That wallet (seq 47) has since swapped the AKT away and now holds ~0.006 OSMO.
• The link from his swapped AKT to this case wallet is now PROVEN: 9 lockstep tx pairs — each funder→case send is exactly 0.13 OSMO less than the matching osmo1w05l…→funder send. The funder sent 7,890,851.15 OSMO to this wallet in 51 transfers. CORRECTION: the 7xpfv “marker key” is the chains’ fee_collector module account (those small amounts are gas fees), not an operator tag.
• Holds 3,747,743.42 OSMO + small IBC holdings (COOK, P2P, DEC, HUAHUA, ODIN). Verified Nov 7 22:06 UTC. No AKT left in it — consistent with the AKT already being swapped.
• Sequence 13010, account 2941961 — an old, active account that has signed 13,010 transactions. The main drain wallets are all sequence 0 (never signed). This one is different: it is active and CAN move money.
• Every incoming transfer we found came from ONE sender — osmo13pet0...neaad94 (osmo13pet0rwjjzgz7f3058xklc2y05eg5cjneaad94). Not from thousands of victims. That sender is the wallet's only funder.
• It DID receive money during the drain — including 2,499,999.87 OSMO on Nov 7 10:01:25 UTC (forwarded 10:02:52 UTC), right in the middle of the attack, from that same sender.
• The sender still holds 579.19 AKT on Osmosis — a remainder, consistent with swapping AKT for OSMO in batches and leaving a little behind.
• It never sent anything to the main Osmosis drain wallet (osmo1atuap…). It does not appear in our full block scans of the drain.
• Verdict: his 40,066.86 AKT theft is PROVEN on-chain — but it happened Nov 1, before the Keplr hack, so it is likely a separate theft. The case wallet is still not confirmed as a main drain wallet. The full trail is proven: 12,888 AKT → 159,744 OSMO into this wallet, and 27,178.85 AKT → 33,096.36 TIA, IBC’d to the attacker’s Celestia address celestia1w05l… (tx 6AB14050…).

• His theft is proven and traced to Osmosis — but it happened Nov 1, five days before the Keplr hack. It is likely a separate theft, and his funds did not go to the main drain wallets (the 4 on the Wallets tab).
• The final hop — from his swapped AKT to this case wallet — is now proven: 9 lockstep tx pairs tie osmo1w05l… → the funder → this wallet, and the full 40,066.85 AKT is accounted for (159,744 OSMO here + 33,096.36 TIA on Celestia). The 7xpfv “marker” turned out to be the chains’ fee_collector module account, not an operator tag.
• His 40,066 AKT accounts for 159,744 OSMO of the 3.75M OSMO in this wallet — proven on-chain. The rest came from other sources: the funder has forwarded OSMO here since ~Sep 19.
• Unlike the main drain wallets (sequence 0, frozen in place), this wallet is active and can move money — that is why it is tracked live here.
• $0 has moved out of the main drain wallets. The drain has resumed on Osmosis (fresh victim sends since Nov 7 ~23:24 UTC); the other three chains are quiet. On a freeze: Osmosis says it is only possible with a chain upgrade, done in bulk (all accounts together). Exchanges usually act only after a police/cybercrime report is filed — he now says he WILL file one the moment it hits an exchange. Remaining levers: tracking, Keplr, and a possible bulk freeze.

• He posted his address — done. The theft chain is now fully proven and the hashes are on this tab. The open lead is where the 33,096 TIA went after the attacker’s Celestia address.
• Report it now: send his AKT address + the thief's addresses + the three hashes (5A82C4FC…, 5DCDA1DC…, CEA57DBA…) + Nov 1 timestamps to Akash and Osmosis security, Keplr/Web3Auth incident response, and the exchanges' security desks to ask for a freeze on osmo10p7dg…, osmo13pet0… and osmo1ctpu5…. He has to ask the exchanges himself — Osmosis can't do it for him. A police/cybercrime report would unlock exchange action — he now says he WILL file one the moment it hits an exchange.
• Move what is left to a recovery-phrase or hardware-wallet account. Do not send new funds to the affected account. Do not re-import it anywhere.
• Ignore every DM offering recovery. They are all scams.