Web3Auth has moved approximately $5.6 million in cryptocurrency from vulnerable Keplr wallets into verified recovery addresses after a flaw in its embedded-wallet infrastructure exposed private keys for some users who signed in through Google or Apple. The company published 12 recovery addresses on November 8, 2026, following blockchain investigators' earlier identification of several of the same destinations as attacker-controlled wallets.
The clarification reshapes the financial picture of the incident. Blockchain analytics firm Bitquery had previously estimated that an attacker drained about $6.01 million from more than 44,000 Keplr wallets across seven Cosmos chains, with another 7,603 affected addresses on Injective. However, eight addresses that Bitquery linked to the suspected attacker later appeared on Web3Auth's recovery list, meaning the initial theft estimate may include protective transfers rather than confirmed losses.
According to Web3Auth, the recovery operation used the same access mechanism exploited in the original incident, making some protective transfers indistinguishable from unauthorized withdrawals on-chain. The operation also moved approximately 1.96 million ATOM in staked assets through liquid-staking mechanisms, bypassing the normal 21-day unbonding period. The published recovery addresses cover assets on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, alongside an EVM address for eight additional chains. Keplr has relayed the list and described the destinations as recovery addresses, not malicious wallets.
Keplr co-founder Josh Lee estimated that roughly 20% of accounts using Google or Apple social login could have been exposed, though only a fraction appeared to have been exploited. Keplr has paused social-login functionality and advised affected users not to deposit additional funds into potentially compromised accounts. Web3Auth said it is working with Keplr to return secured assets, but no final recovery total, claims procedure, or reimbursement timetable has been published. The companies also warned users about impersonators and fraudulent recovery requests.
The incident originated in Web3Auth's infrastructure rather than Keplr's wallet application. Web3Auth, acquired by Consensys in June 2025, provides embedded-wallet technology that lets users create and access wallets through Google and Apple authentication without managing a conventional recovery phrase. A technical root-cause report has not yet been released, and Web3Auth has not disclosed how many individual customers suffered confirmed losses.
