Web3Auth, the Consensys-backed platform managing Google and Apple authentication for the Keplr crypto wallet, stated it transferred assets out of at-risk Keplr accounts to shield them from a malicious actor. Onchain analytics examined by The Block show that the 12 addresses housing these retrieved funds held approximately $5.6 million in digital assets as of Sunday’s publication time.
Both entities explained that a security vulnerability within Web3Auth’s infrastructure compromised the private keys of specific Keplr Wallet users who registered via Google or Apple credentials. Although initially built for the Cosmos network, Keplr presently accommodates numerous non-Cosmos networks, including EVM-compatible chains, and reported in 2025 that its user base exceeded 2 million participants.
“This was not a breach of Keplr’s codebase. The problem originated at Web3Auth, a service utilized by Keplr,” posted Keplr co-founder Josh Lee on X, estimating that roughly 20 percent of Keplr accounts utilizing Google and Apple logins were impacted. Keplr noted that individuals who configured Keplr using a seed phrase or a hardware wallet remained unaffected.
Rescue efforts initially confused with theft
Web3Auth announced on Saturday that it had begun draining vulnerable wallets that the perpetrator had not yet breached, employing “the exact path of the original attacker.” Web3Auth mentioned, “Assets retrieved through this procedure are secure, and we are collaborating with Keplr to establish a recovery roadmap for users.”
Web3Auth’s mention of an “original attacker” implies that certain wallets were emptied prior to the commencement of the rescue operation. Web3Auth has not disclosed the total count of wallets targeted by the hacker or the exact sum stolen, and did not immediately reply to The Block’s inquiries for additional details.
“We understand that a number of these transfers were mistaken for malicious activity,” stated Web3Auth early Sunday when releasing its rescue addresses. Blockchain intelligence firm Bitquery shared on Saturday that a perpetrator had amassed roughly $6 million from over 44,000 Keplr wallets. Every single one of the eight addresses linked to the thief by Bitquery appears on Web3Auth’s rescue index.
The bulk of the retrieved assets reside on Cosmos Hub, where the primary Web3Auth recovery address maintains about 2.49 million Cosmos Hub (ATOM) tokens, valued near $3.3 million. A significant portion of those ATOM tokens had been staked, and the sweep operations converted them into liquid tokens capable of immediate transfer instead of forcing a wait through the network’s standard 21-day unbonding period.
Users advised to relocate remaining funds
Lee stated on Saturday that a large portion of vulnerable profiles likely escaped the assault. “It appears only a small fraction of that 20 percent was actually compromised, and the remaining profiles might still be salvageable,” he posted. Keplr cautioned that certain profiles “might already display a diminished or zero balance because of these defensive actions.”
Keplr instructed users relying on Google and Apple sign-ins to refrain from depositing any funds into their accounts, recommending instead that they transfer any remaining balances to a wallet secured via a seed phrase or a hardware device. Keplr added that it is working alongside Web3Auth to build a tool enabling users to verify if their profiles were compromised.
Web3Auth initially revealed the situation on Friday afternoon and temporarily halted the feature allowing applications to generate wallets via social authentication. The firm reported no indications that users of MetaMask, the flagship wallet developed by Consensys, were impacted. Consensys purchased Web3Auth in June 2025 and currently brands the offering as MetaMask Embedded Wallets, according to its developer documentation.
The Block has reached out to Web3Auth, Consensys, and Keplr for statements.
Originally published at https://www.theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029.
