Skip to content

Instantly share code, notes, and snippets.

@koitsu
Created November 6, 2025 15:00
Show Gist options
  • Select an option

  • Save koitsu/d22f05192ecbc1bc16770c5e857af502 to your computer and use it in GitHub Desktop.

Select an option

Save koitsu/d22f05192ecbc1bc16770c5e857af502 to your computer and use it in GitHub Desktop.
Why Keplr with Ledger (and RUNE) is dangerous

Test 1 -- Keplr extension

Keplr wallet setup:

  • Chose: Connect Hardware Wallet
  • Chose: Connect Ledger
  • Chose: Connect to: Cosmos app (Recommended)
  • Launched Cosmos app on Ledger
  • Chose: Next
  • Chains: left default (all 47, which includes THORChain and Cosmos)
  • Chains: chose Skip
  • Chains: chose Skip again
  • Chains: chose Skip again

THORSwap setup:

  • Chose: Wallet
  • Chose: Keplr (under Detected Wallets)
  • UNSELECTED Kujira chain
  • Chose: Connect

Wallet address results:

  • THORChain: thor1xtr036h5t7s7nu03j76pxj2gatlwlpv5n3elwt
  • Cosmos: cosmos1xtr036h5t7s7nu03j76pxj2gatlwlpv54kqym5

Test 2 -- Keplr extension

Keplr wallet setup:

  • Chose: Connect Hardware Wallet
  • Chose: Connect Ledger
  • Chose: Connect to: THORChain app
  • Launched THORChain app on Ledger
  • Chose: Next
  • Chains: left default (all 47, which includes THORChain and Cosmos)
  • Chains: chose Skip
  • Chains: chose Skip again
  • Chains: chose Skip again

THORSwap setup:

  • Chose: Wallet
  • Chose: Keplr (under Detected Wallets)
  • UNSELECTED Kujira chain
  • Chose: Connect

Wallet address results:

  • THORChain: thor1zr5av4rqfmhjekfvwafdgk4pentjvkx3e5k4ct
  • Cosmos: cosmos1zr5av4rqfmhjekfvwafdgk4pentjvkx3ln0wd5

Analysis part 1

It's clear the wallet address results VARY depending on the type of "connection" you choose in Keplr account setup: either "Cosmos app" or "THORChain app". I cannot tell what the derivation path that's used for either configuration since neither Keplr extension nor Ledger apps expose this info. Disappointing. However, I suspect Cosmos app = coin type 118 and THORChain app = coin type 931, as that would make the most sense.

It makes no sense whatsoever that you could have a Cosmos/ATOM address using coin type 931 in the derivation path. 931 is only for THORChain, which means RUNE, TCY, and (legacy) NAMI.

Regardless, let's verify derivation paths by NOT using Keplr and connect Ledger DIRECTLY (via USB) to THORSwap instead!

Disabled Keplr extension

Disabled under chrome://extensions/ . I did not want any chance of there being something that might intercept the USB port during the below tests.

Test 3 -- Ledger directly (USB) w/ Cosmos Ledger app

Launched Cosmos app on Ledger.

THORSwap setup:

  • Chose: Wallet
  • Chose: Hardware Wallets & Keystore
  • Chose: Ledger
  • Chose: Cosmos chain

Note that at this point (in THORSwap) you can only select an index number (derivation path). However, Expert Mode in THORSwap might let us choose full derivation path. But we'll fool with that in a later test.

Wallet address results:

  • Cosmos: cosmos1xtr036h5t7s7nu03j76pxj2gatlwlpv54kqym5

Test 4 -- Ledger directly (USB) w/ THORChain Ledger app

Launched THORChain app on Ledger.

THORSwap setup:

  • Chose: Wallet
  • Chose: Hardware Wallets & Keystore
  • Chose: Ledger
  • Chose: THORChain chain

Wallet address results:

  • THORChain: thor1zr5av4rqfmhjekfvwafdgk4pentjvkx3e5k4ct

Analysis part 2

From the above tests we can see that directly connecting Ledger to THORSwap via USB that the wallet address (per chain) match that of "Cosmos app" and "THORChain app" on a per-chain basis.

This makes us ask: where is Keplr app getting the other addresses from? I'm talking about thor1zr5av4rqfmhjekfvwafdgk4pentjvkx3e5k4ct (for Cosmos app but THORChain chain) and cosmos1zr5av4rqfmhjekfvwafdgk4pentjvkx3ln0wd5 (for THORChain app but Cosmos chain).

Let's continue and see if we can "override" the derivation path in THORSwap to try and get these two other "mystery" addresses. Whether or not they functionally work is a different story, but let's at least try.

THORSwap Expert Mode test

Repeats of Test 3 and Test 4 DID NOT offer a pulldown for a custom derivation path for neither Cosmos chain nor THORChain chain. However, other chains like Ethereum DID offer this feature.

From this we can conclude that Keplr extension is causing confusion. I still have no idea how anything is FUNCTIONAL with the "bogus" addresses.

Conclusion

It's clear to "undo the damage" from this, one MUST use Keplr extension, as it's the only way (at least via THORSwap) to get access to these "bogus" addresses (and thus hopefully the funds associated with those).

Keplr extension DOES NOT let you select coin type manually during wallet setup, even if choosing Custom Derivation Path -- they only let you adjust account and index fields of the derivation path. So, it seems the coin type field is entirely based on what you choose in their wallet: "Cosmos app" or "THORChain app".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment