Key takeaways
- Web3Auth moved millions from vulnerable Keplr crypto wallets
- Google and Apple login users faced private-key exposure
- Initial theft estimates mistakenly included some protective transfers
Crypto wallet infrastructure provider Web3Auth says it moved millions of dollars from vulnerable Keplr wallets before hackers could reach them, using the same security weakness that exposed users' private keys.
In a November 7 statement, the Consensys-owned company confirmed it had begun emergency recovery operations targeting Keplr accounts created through Google and Apple sign-ins.
By November 8, twelve published recovery addresses held approximately $5.6 million in cryptocurrency, according to an independent review of blockchain transactions. Web3Auth says the assets are secure and that it is working with Keplr on returning them to their owners.
Web3Auth Moves $5.6 Million Before Hackers Can Reach Wallets
The incident began after a vulnerability in Web3Auth's infrastructure exposed private keys associated with some Keplr wallets using social-login authentication.
Keplr co-founder Josh Lee estimated that approximately 20% of accounts created through Google and Apple sign-ins were potentially affected, although only a fraction appeared to have been exploited.
Web3Auth responded by launching a white-hat recovery operation, transferring assets from exposed wallets into addresses controlled by the recovery team.
Unusually, the company said its security responders used the same access method as the original attacker, allowing them to reach vulnerable funds before further unauthorized withdrawals occurred.
The recovery effort involved several blockchain networks, including Cosmos Hub, Osmosis and Injective.
Approximately 2.49 million ATOM, valued around $3.3 million, was held in the published Cosmos Hub recovery address on November 8.
The incident illustrates how compromised wallet infrastructure can create security risks even when the underlying blockchain remains operational, a distinction also highlighted by recent cryptocurrency security investigations.
Why Researchers Initially Reported a $6 Million Theft
Blockchain analytics firm Bitquery initially reported that approximately $6.01 million had been drained from more than 44,000 Keplr wallets across multiple Cosmos networks.
However, Web3Auth subsequently disclosed that several addresses identified during the investigation belonged to its own recovery operation rather than attackers.
The company published the relevant addresses on November 8, explaining that protective transfers had been mistaken for malicious activity.
This means the $6.01 million figure cannot be treated as a verified total of stolen cryptocurrency.
Web3Auth has not disclosed how much was taken by the original attacker, how many accounts suffered permanent losses or when affected users will receive their recovered assets.
The confusion resembles a broader challenge in crypto theft investigations, where blockchain transfers reveal movements of funds but do not automatically establish who authorized them.
In this case, transfers from vulnerable wallets could represent either unauthorized withdrawals or emergency recovery measures.
Keplr Warns Google and Apple Login Users
Keplr has temporarily disabled Google and Apple login functionality while the investigation continues.
The wallet provider says accounts created directly with recovery phrases or connected through hardware wallets were not affected by the identified vulnerability.
Users who created wallets through social logins have been advised not to deposit additional funds into those accounts and to transfer any remaining liquid assets into securely created wallets.
Keplr also warned that some affected accounts could display reduced or empty balances because assets had been moved during the emergency recovery.
The warning comes amid broader concerns about wallet phishing attacks and fraudulent recovery services targeting cryptocurrency users.
