Web3Auth Says It Beat Hackers to $5.6M in Exposed Keplr Wallets

Web3Auth says it pulled roughly $5.6 million in crypto out of vulnerable Keplr wallets ahead of the attackers. The Consensys-owned wallet infrastructure provider confirmed the emergency operation in a November 7 statement, targeting Keplr accounts created through Google and Apple sign-ins. By November 8, twelve published recovery addresses held the assets, according to an independent review of blockchain transactions.

The root cause: a vulnerability in Web3Auth's own infrastructure that exposed private keys tied to certain Keplr wallets using social-login authentication. Keplr co-founder Josh Lee estimated that about 20% of accounts created via Google and Apple sign-ins were potentially affected, though only a slice appears to have been actually exploited.

In an unusual move, Web3Auth's responders reached the vulnerable funds using the same access method as the original attacker. The recovery spanned several networks, including Cosmos Hub, Osmosis and Injective. One published Cosmos Hub address alone held about 2.49 million ATOM, worth around $3.3 million on November 8. Web3Auth says those assets are secure and that it's working with Keplr to hand them back to owners.

The rescue muddied the numbers. Blockchain analytics firm Bitquery initially reported that about $6.01 million had been drained from more than 44,000 Keplr wallets across Cosmos networks. Web3Auth later said some of those addresses were its own recovery operation, not the thieves — protective transfers mistaken for malicious ones. That means the $6.01 million figure can't be treated as a verified theft total.

What remains unspoken matters. Web3Auth hasn't said how much the original attacker got, how many accounts took permanent losses, or when users will see recovered funds again. Keplr has temporarily switched off Google and Apple login functionality while the probe continues, and says wallets made with recovery phrases or hardware devices were untouched.

For now, users who signed up through social logins are told not to deposit more into those accounts and to move any remaining liquid assets into securely created wallets. Keplr also warned that some affected accounts may show reduced or empty balances — a side effect of the emergency sweep. It's a messy reminder that a healthy blockchain doesn't guarantee healthy wallet infrastructure, and that separating a white hat's transfers from a thief's isn't always obvious on-chain.