✓ Verified by 3+ outlets
Web3Auth says it moved about $5.6M out of exposed Keplr wallets before attackers could, disputing a $6M theft estimate
Summary
Web3Auth, the Consensys-owned service behind Keplr Wallet's Google and Apple sign-in, says it swept funds out of Keplr social-login wallets whose private keys were exposed by a flaw in its systems, moving them to recovery addresses before an attacker could reach them, The Block and Crypto Briefing reported.
The Block said the 12 recovery addresses Web3Auth published early Sunday held about $5.6 million in crypto by its review of onchain data, mostly about 2.49 million ATOM (roughly $3.3 million) on Cosmos Hub, while Crypto Briefing said the published list spans eleven Cosmos-based networks and eight EVM-compatible chains; The Defiant reported that Keplr confirmed the addresses.
Web3Auth says an earlier figure of about $6 million stolen, from blockchain data firm Bitquery, counted its own protective sweeps as theft because they used the same route as the attack; The Block found all eight addresses Bitquery tied to the thief are on Web3Auth's recovery list.
Web3Auth also referred to an “original attacker” and has not said how many wallets were drained or how much was actually lost, The Block reported. Keplr says users who set up with a recovery phrase or hardware wallet are not affected and told Google and Apple login users to move remaining funds out.
Key facts
- The Block: Keplr co-founder Josh Lee wrote on X, “This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses,” estimating that about 20% of Keplr's Google and Apple login accounts were affected; Crypto Briefing reported the same ~20% estimate.
- The Block: Web3Auth said it had started emptying vulnerable wallets the attacker hadn't reached, using “the same path of the original attacker,” and that “Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users.”
- The Block: The 12 recovery addresses Web3Auth published early Sunday held about $5.6 million in crypto at publication time, by The Block's review of onchain data; the Cosmos Hub address held about 2.49 million ATOM, worth roughly $3.3 million.
- Crypto Briefing: Web3Auth's published list of verified recovery addresses covers eleven Cosmos-based networks and eight EVM-compatible chains (The Block counted 12 addresses).
- Crypto Briefing: Bitquery tracked more than 44,041 affected wallets in the Cosmos ecosystem and 7,603 on Injective; Web3Auth calls the resulting $6.01 million theft estimate false because the funds moved to its recovery wallets. The Block said all eight addresses Bitquery tied to the thief are on Web3Auth's recovery list.
- The Block: Web3Auth has not said how many wallets the attacker hit or how much was taken. Keplr warned some accounts “may already show a reduced or empty balance as a result of these mitigation efforts.”
- The Block: Web3Auth first disclosed the issue Friday afternoon (Nov. 6) and paused its social-login wallet service; it said it found no evidence MetaMask users were affected. Consensys acquired Web3Auth in June 2025 and markets it as MetaMask Embedded Wallets.
- The Defiant: Keplr confirmed Web3Auth's recovery addresses; the list includes the destination of a six-account Cosmos Hub batch that tokenized 2,265.59 staked ATOM.