Web3Auth says it drained vulnerable Keplr wallets before the hackers could — and is holding $5.6M

A flaw in Web3Auth, the Consensys-owned service that powers Google and Apple sign-in for the Keplr wallet, exposed the private keys of some Keplr users who registered with a social login — and Web3Auth says it responded by racing an attacker to empty the at-risk wallets itself.

The firm published 12 recovery addresses early Sunday that hold about $5.6 million in crypto, according to onchain data reviewed by The Block. Web3Auth says the swept funds are safe and that it is working with Keplr to return them. It moved the money, it said, "using the same path of the original attacker" — its own phrasing, which implies some wallets were drained before the recovery began.

Keplr co-founder Josh Lee wrote on X that this "was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses," and estimated that about 20% of Keplr's Google and Apple login accounts were affected. Users who set up Keplr with a seed phrase or hardware wallet are not affected, per Keplr. Lee added that "only a fraction of that 20% has actually been exploited," with the rest potentially recoverable.

The bulk of the recovered funds — roughly 2.49 million ATOM, worth about $3.3 million by The Block's count — sits on Cosmos Hub. Much of that ATOM was staked; the sweeps converted it into immediately movable tokens rather than waiting out Cosmos's 21-day unbonding period.

Key facts

• ~$5.6M held across 12 Web3Auth "recovery" addresses as of Sunday (onchain data via The Block).
• 2.49M ATOM ($3.3M) is on Cosmos Hub, much of it unstaked during the sweep (The Block).
• ~20% of Keplr's Google/Apple login accounts affected; only a fraction exploited (Keplr's Josh Lee, X).
• Blockchain analytics firm Bitquery reported Saturday that a thief took ~$6M from 44,000+ Keplr wallets; all 8 addresses Bitquery tied to the thief are on Web3Auth's recovery list (The Block, citing Bitquery).
• Web3Auth disclosed the issue Friday afternoon and paused social-login wallet creation; it says MetaMask users are unaffected. Consensys acquired Web3Auth in June 2025 and now markets it as MetaMask Embedded Wallets (The Block, Consensys docs).

The real-world read

Treat the "white-hat rescue" framing with care — it is Web3Auth's own account of a breach Web3Auth caused. The overlap between Bitquery's eight attacker addresses and Web3Auth's recovery list is the reason the firm had to clarify that some transactions were "mistaken for attacker activity"; onchain, a protective sweep and a theft look identical. Critically, Web3Auth has not said how many wallets the real attacker hit first, or how much was taken before it intervened — so the $5.6M figure is what Web3Auth now controls, not the total exposed. There is also no mechanism yet for users to confirm whether their own account was affected; Keplr says it is still building one. Until funds are actually returned, affected users are trusting the company that lost their keys to give the money back.

This is news, not financial advice.

Sources

• The Block (DeFi desk), Nov. 8, 2026 — primary reporting; onchain data analysis; quotes from Web3Auth statements, Keplr's Josh Lee (X), and Bitquery's Saturday report. Secondary outlet relaying primary statements.