URGENT SECURITY REPORT: theft of staked ATOM via LSM Tokenize Shares, Cosmos Hub
Transaction: D2283D7E35CC2B844BB29D2C5B904CBE598DE8B92549EE6A106E4AD735311599 Height 33,766,882, Nov 7 2026, 10:18:55 UTC. Memo: “lsm recovery batch”. 27 messages: Send, Modify Withdraw Address and Tokenize Shares, repeated across several delegators. Attacker address (new owner of the tokenized shares and new withdraw address): cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu Batch sender (self-send of 0.000001 ATOM in message #1 ): cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0 My address (victim): cosmos1tpkpt8l2aup6m2exjpw84mj9ww302q3dltfvls Messages #9 and #10: withdraw address changed, then 356.009956 ATOM tokenized (validator: Cryptostake_com). I never signed this transaction and never granted authz permissions to anyone. The authz grants query for my address currently returns an empty list. It is unclear how a single transaction could include actions for several unrelated delegators, so this looks like a mass key compromise or a compromised signing service. Addresses were copied from Mintscan, so please verify them against the transaction hash. Requests: 1. Flag the attacker address and track any Redeem, Undelegate or outgoing transfers. 2. Alert…
Excerpt (1189 of 1470 characters). Read the whole post on the forum ↗
This post was flagged by the community and is temporarily hidden.
Reposting from Cosmos Hub’s X - Follow updates on Keplr’s and Web3Auth’s official channels.
x.com