Web3Auth used the attack path to move at-risk Keplr funds into recovery wallets

An attacker exploited a Web3Auth security flaw to move cryptocurrency out of Keplr wallets built with Google or Apple sign-in. Web3Auth then used the same access path to move money out of other at-risk wallets and into recovery wallets ahead of the attacker, both companies said. Web3Auth paused its embedded wallet service on Nov. 6, 2026 at 21:13 UTC after confirming a security issue. Keplr disabled Google and Apple login on Nov. 7, 2026 after detecting unauthorized transactions..

Keplr called the incident a private key breach affecting some users who logged in through Google or Apple. A private key is the secret code used to approve payments, and anyone who holds it can move the funds without a password or owner confirmation. For social-login accounts, Web3Auth generates private keys through distributed key generation, dividing the key into shares kept in different locations that cooperate at login. Cointribune, citing Bitquery, said about 44,700 private keys were exposed; Web3Auth and Keplr have not disclosed how the flaw worked, when the attacker first used it, or whether the access route remains closed.…

Bitquery said at least $6.01 million moved out of more than 44,000 wallets and into recovery wallets by late last week, and said about $6.01 million went to two receiving addresses tied to the suspected attacker. GoPlus put the stolen amount at least about $1 million in a security alert, without explaining how it reached the figure. Web3Auth disputes the $6.01 million theft estimate, saying the money went to verified recovery wallets instead of to an attacker, and published a list of 12 recovery addresses holding about $5.6 million across eleven Cosmos-family blockchains and eight Ethereum-style chains. Web3Auth pointed to an original attacker without saying how much was taken before its own transfers, while no final dollar amount for the theft has been released by any company….

Web3Auth’s recovery move traveled the attacker’s own technical path, so protective transfers initially looked no different from unauthorized withdrawals. Bitquery data shows the first recovery transfers arrived 21 minutes ahead of Web3Auth’s first public notice. Bitquery first called the transfers theft, then published a corrected analysis describing them as a rescue. Blockchain records alone cannot identify who holds a receiving address, and they cannot prove whether a transfer was theft or a protective intervention….

Josh Lee, Keplr’s co-founder, estimated that about 20% of accounts made with Google and Apple logins might have been affected. He said only a fraction of those potentially affected accounts seem to have been exploited.…

After Keplr warned users, the company said 86% of affected wallets were emptied. Bitquery counted about 44,041 affected addresses on seven Cosmos chains, plus another 7,603 on Injective. Median wallet losses were $1.34, with the largest individual transfer approaching $325,000. Transfers totaled nearly $3.50 million for Cosmos Hub, $1.04 million for Osmosis, and $615,000 for Injective.…

About 1.96 million staked ATOM moved without the normal 21-day unbonding period through liquid-staking mechanisms. Staked and locked assets are taking longer to secure because they cannot move immediately.…

Keplr said wallets created with either a 12-word or 24-word recovery phrase, or tied to a hardware wallet, are not affected. Web3Auth said its initial investigation uncovered no evidence that the issue impacted MetaMask users, and said the issue touches services that some other companies use, naming only Keplr. Consensys, which makes MetaMask, acquired Web3Auth in June 2025.…

Keplr told users not to add new funds to affected accounts, not to re-import or recreate them, and to move liquid funds into accounts secured by recovery phrases or hardware wallets. It told users to trust only updates from official accounts and to disregard direct messages or links promising recovery. Keplr is working with Web3Auth on a tool so users can check whether their account was affected, though no date has been set, and it posts verified updates on its official X account….

Web3Auth said the funds it recovered are safe, and that it is working with Keplr on returning them, but the company has not given a timing or method for returning the funds. Neither company has published a full claims process, a recovery timeline, or a compensation pledge. Web3Auth has not issued a report explaining how its infrastructure exposed private keys, or what safeguards would stop a recurrence. Web3Auth can still sign transactions for its users, even during a security crisis.…