A Keplr wallet user reported that 1,200 ATOM tokens were moved without authorization while the wallet was undergoing a recovery process. The recipient address does not appear on Keplr's November 8 recovery list, raising questions about who controls the destination wallet. The stolen assets are currently in an unbonding state, meaning they have been unstaked but remain locked until the unbonding period completes. The incident highlights ongoing security concerns surrounding wallet recovery procedures and the risks users face during such processes.