Update: @Web3Auth has confirmed that the addresses in my post are the wallets it used to rescue users' funds, not the thief's. They hold about $6.0M. Web3Auth started moving funds into them at 20:52 UTC on Nov 6 and only named them 33 hours later, while they were being reported everywhere as the attacker's. There was no reason to hold them back. The attacker knew those wallets weren't his, and once Web3Auth said it was securing funds, naming the wallets gave him nothing. Keeping them quiet only left users unable to tell a rescue from a theft and caused unnecessary panic. Don't disable LSM. It could block the recovery of staked ATOM. The theft did happen: - At least $1.0M taken, starting 01:28 UTC on Nov 5, 44 hours before Web3Auth paused its service - $878K swept from victims on Osmosis, almost all bridged to Ethereum, and $128K taken from victims' THORChain balances - About 2.4 BTC already cashed out through THORChain One account was drained again after the rescue, so the leaked keys still work. Don't send new funds to those accounts. Attacker addresses in the reply.