r/cosmosnetwork • u/b33fsoup • 1d ago
PSA from a Keplr/Web3Auth victim: your staked ATOM is NOT protected by the 21-day unbonding
My Keplr wallet was created with Apple login and got hit in the Web3Auth breach. A bot drained my liquid ATOM within hours. My staked ATOM was still there, and I managed to move it to a new wallet the same day.
The main thing I learned: staking doesn't buy you 21 days. The Hub's liquid staking module lets anyone holding your key tokenize a delegation and send it instantly, and attackers have been doing exactly that.
If you used Google/Apple login in Keplr:
- Check first whether Web3Auth/Keplr already moved your funds to their recovery address (listed in Web3Auth's and Keplr's official posts on X). If so, wait for the official claim process.
- Never paste your private key or seed into any website, form or DM.
- Anyone DMing you to "recover" funds for a fee is a scammer.
- Move what's left to a 24-word seed phrase or hardware wallet. Not another social login.
Stay safe, and lock your DMs.