Transaction: D2283D7E35CC2B844BB29D2C5B904CBE598DE8B92549EE6A106E4AD735311599
Height 33,766,882, Nov 7 2026, 10:18:55 UTC. Memo: “lsm recovery batch”. 27 messages: Send, Modify Withdraw Address and Tokenize Shares, repeated across several delegators.
Attacker address (new owner of the tokenized shares and new withdraw address):
cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu
Batch sender (self-send of 0.000001 ATOM in message #1):
cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0
My address (victim): cosmos1tpkpt8l2aup6m2exjpw84mj9ww302q3dltfvls
Messages #9 and #10: withdraw address changed, then 356.009956 ATOM tokenized (validator: Cryptostake_com).
I never signed this transaction and never granted authz permissions to anyone. The authz grants query for my address currently returns an empty list. It is unclear how a single transaction could include actions for several unrelated delegators, so this looks like a mass key compromise or a compromised signing service. Addresses were copied from Mintscan, so please verify them against the transaction hash.
Requests:
1. Flag the attacker address and track any Redeem, Undelegate or outgoing transfers.
2. Alert validators, exchanges and bridges so they can freeze or refuse the funds.
3. Help investigate how the transaction was signed for multiple delegators.
4. Tell affected delegators what to do and whether any mitigation on the Hub is possible.
Contact: [Stan / Dzystas@meta.ua]