Web3Auth Flaw Drains 44,000 Keplr Wallets — $6 Million Gone, Can It Come Back?

44,000 wallets. Two days. And the thief never touched Keplr's own code. The keys walked out through the login button — the same Google sign-in that lets you open a wallet without writing down a seed phrase.

Key points:

• A flaw in Web3Auth exposed the private keys of Keplr users who signed in with Google or Apple instead of a seed phrase.
• Bitquery traced about $6 million leaving more than 44,000 wallets — but part of that sum is Web3Auth's own rescue sweep, so the true stolen amount is still unknown.
• Web3Auth moved about $5.6 million into 12 recovery wallets, and Keplr says seed-phrase and hardware-wallet users were not hit.

What actually broke

Web3Auth runs the social login for Keplr, a wallet built for Cosmos, a family of linked blockchains that includes Cosmos Hub, Osmosis and Celestia. Its job is simple: let people open a wallet with a Google or Apple account, no 24-word seed phrase to write down and guard. Late on Friday, Web3Auth said it had found a security issue in that service and paused it. By then, the private keys of some social-login users were already exposed.

Keplr confirmed the thefts early on Saturday morning, at 04:38 UTC, and told users that accounts made with a Google or Apple login had seen transactions their owners did not make. Keplr paused the Google and Apple login at once. Seven hours earlier, Web3Auth had already reported the issue and paused its own wallet service. Neither firm has said how the keys got out. My own read is plain: A wallet that skips the seed phrase is a wallet that trusts someone else with your keys. That trade felt safe until Friday. It does not feel safe now.

Read also: Gnosis Pay Data Breach Exposes Customer Details, Funds Safe as Shutdown Nears

The rescue used the same door as the thief

On Saturday, Web3Auth started emptying the wallets the attacker had not reached yet, using what it called the same path the original attacker used. The money went to 12 recovery wallets that held about $5.6 million by Sunday, onchain data reviewed by The Block shows. Most of it sits on Cosmos Hub, where one recovery address holds about 2.49 million ATOM, worth roughly $3.3 million.

Web3Auth said the recovered funds are safe and that it is working with Keplr on a way to give them back. It also warned that some of its own rescue moves have been mistaken for attacker activity, which is why the numbers flying around on social media keep shifting. For now, the recovery is a promise, not a process — no date, no claim form, no payout plan has been published yet.

The $6 million figure is messier than it looks

Bitquery, a blockchain analytics firm, reported on Saturday that a thief had collected about $6 million from more than 44,000 wallets. Its count is exact: at least 44,041 wallets on seven Cosmos chains, plus 7,603 more on Injective. The biggest single loss was $325,000. And 86% of the wallets were emptied after Keplr had already warned its users — pausing the login did not help, because the attacker already held the keys. The attacker even pulled 1.96 million staked ATOM out without waiting the usual 21 days to unbond, and picked up $251,000 in staking rewards on the way.

But here is the catch. All eight addresses Bitquery tied to the thief also sit on Web3Auth's recovery list. That means the $6 million mixes two things: what the thief took, and what Web3Auth itself swept to safety. Neither side has said how much the attacker really got. Web3Auth has not said how many wallets the attacker hit or how much was taken, and it did not answer The Block's request for more detail. So read the $6 million as an upper line, not a final theft total. Bitquery's two collecting addresses have not sent a single transaction since, which fits a rescue hold — or a thief waiting for the noise to die down. Nobody can tell which yet.

Who is safe, and who is not

Keplr co-founder Josh Lee put the blame where it belongs. "This was not a hack of Keplr's code," he wrote on X. "The incident originated at Web3Auth, a provider Keplr uses." He put the exposed share at about 20% of Keplr's Google and Apple login accounts, and added that only a small part of that 20% looks exploited so far, with the rest possibly recoverable.

Anyone who set up Keplr with a recovery phrase or a hardware wallet is not affected, Keplr said. Web3Auth said it found no sign that MetaMask users were hit, even though MetaMask runs on the same base tech. New social-login signups are paused, and Keplr is telling people who made a wallet through Google or Apple to stop sending funds into it and move what is left out.

Check your wallet now

If you ever opened Keplr with Google or Apple, do not wait for a recovery form. Open the wallet and check every transaction since Friday — the drain ran on November 6 and 7, and most of it happened after Keplr's own warning. Move any funds still sitting in a social-login wallet to a fresh wallet made with a seed phrase, and write that phrase down on paper, not in a screenshot. Note three numbers before you act: your balance on each chain, the date of the last transaction you did not make, and the address your funds went to.

Then watch four things. First, Web3Auth's recovery plan: how and when the $5.6 million goes back to its owners. Second, whether the collecting addresses move any funds — nothing has moved so far, and the first move will tell us who really holds the money. Third, Keplr's next statement on how many wallets were truly hit. And fourth, the price of ATOM: most of the rescued money sits in ATOM, so a sharp slide would shrink the recovery pot before it is ever paid back.

Read also: Binance Hack Aftermath: How to Keep Your Crypto Safe in 7 Steps

— BitByLine News Desk

This post is news only, not financial advice. BitByLine never tells anyone to buy or sell crypto — that choice is always yours, and the risk is yours too. Always do your own research first.

Read our full Disclaimer.

Sources: The Block, Bitquery.