More than 44,000 wallets from Keplr sent funds to Web3Auth recovery addresses during the response to a breach that affected users who signed in with Google or Apple. The transfers totaled at least $6.01 million according to Bitquery's figures, which initially interpreted them as a theft and later corrected its analysis: Web3Auth and Keplr identified those addresses as safe destinations for rescuing assets.
The correction does not resolve the main question. Neither company has said how much money the attacker stole before the recovery began, how many accounts they managed to empty, or which address they used. They have also not explained how the vulnerability worked or when it was first exploited.
Sign-in with Google and Apple was paused
Keplr is a wallet application for the Cosmos ecosystem. For users who create an account with a recovery phrase, the private key is associated with a list of 12 or 24 words; a hardware wallet can also be used. The social sign-in option lets users log in with a Google or Apple account without directly managing that phrase. Web3Auth provides this service and reconstructs the wallet key when the user signs in.
According to updates from both companies, an issue in Web3Auth's infrastructure affected some wallets integrated into the Keplr app. Keplr described the impact as a «private key breach» for certain Google or Apple users: the private key is the secret that authorizes wallet transactions. The company suspended both sign-in methods while it investigates; Web3Auth, for its part, paused its embedded wallet service, which is used by other applications.
Users began noticing unauthorized transactions and empty balances late on November 6. Bitquery places the first analyzed transfer at 20:52 UTC that day. Within seconds, ten Cosmos Hub wallets sent small amounts, each worth less than two cents. Web3Auth's first public statement came 21 minutes later, according to Bitquery's timeline.
Keplr published its notice at 04:38 UTC on November 7. The company said that accounts created through Google or Apple may have seen transactions their owners had not authorized, and that wallets backed by a recovery phrase or hardware were not affected. The Hacker News cites an initial estimate from Josh Lee, Keplr's co-founder: around 20% of accounts using Google or Apple sign-in may have been affected, although only a fraction of them appeared to have been exploited.
Rescue transfers were mistaken for theft
Bitquery tracked movements to two addresses that received funds from Keplr accounts: one shared across seven networks in the Cosmos ecosystem and another on Injective. In its first version, published at 16:41 UTC on November 7, it interpreted these sweeps as stolen funds. Twelve minutes later, Web3Auth said it was working with Keplr to secure assets from affected accounts; thirteen minutes after that, it said it had begun a «whitehat» recovery.
On November 8, Web3Auth published a list of verified recovery addresses, and Keplr shared the same list. Bitquery confirmed that the two addresses it had tracked were on the list and rewrote its analysis. The blockchain data firm counted funds from at least 44,041 wallets across seven Cosmos chains and another 7,603 on Injective. Its figure of $6.01 million refers to the recovery addresses, not to a measurement of what the attacker obtained.
The timing pattern alone also cannot distinguish thefts from rescue operations: on-chain, both actions can appear as a transfer from a wallet. Some 86% of the accounts counted across the seven Cosmos chains were swept after Keplr's notice. Web3Auth said its recovery targeted wallets that were «vulnerable but not yet impacted», while other communications referred to affected accounts. Bitquery warns that its data does not reveal which accounts had already been reached by the attacker.
Web3 security firm GoPlus estimated in an alert that at least around $1 million had been stolen, but did not explain how it arrived at that figure. Neither Keplr nor Web3Auth has confirmed that total. The Hacker News also reports that, according to Web3Auth's list and updates, funds moved to the recovery addresses were distributed across 11 networks in the Cosmos family and eight Ethereum-compatible chains.
More than $6 million in the published addresses
In its tally of movements through November 7, Bitquery found that Cosmos Hub accounted for about $3.50 million, almost all of it in ATOM. Osmosis held more than a thousand types of tokens, including USDC, bitcoin, and pool shares. The firm calculated prices as of 15:27 UTC on November 7 and excluded tokens without a market price and one spam token; it therefore described its figures as minimums.
Most affected wallets held small amounts: the median amount moved was $1.34, and 88% of accounts sent less than $100. A few dozen wallets accounted for a third of the total; the largest transferred $325,000. Since the same key can control addresses across multiple Cosmos networks, 46% of the wallets analyzed recorded movements on two or more chains.
Transfers stopped on six chains and on Injective within a 19-second interval, at 10:34 UTC on November 7. Cosmos Hub continued processing movements until 15:33 UTC as staked ATOM was transferred. The pause was temporary: recovery resumed on Osmosis at 18:28 UTC that day to release assets locked in trading pools. By 19:22 UTC on November 8, that address had received another 4,568 transfers; Noble had received 183 since 16:02 UTC that same day. These later movements are not included in Bitquery's total.
The list published by Web3Auth includes Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, and Agoric, as well as EVM addresses for eight chains. Bitquery identified movements on six of the latter: Ethereum, Base, Arbitrum, BNB Chain, Optimism, and Polygon. In its query on November 8, it counted 1,553, 870, 828, 490, 245, and four wallets, respectively, sending funds to the published EVM address, which starts with 0x413e and ends with 06dA.
On November 9, TokenPost reported that Web3Auth considers these transfers part of asset protection and not activity by the attacker. The company said it would add more verified addresses as it confirms them. Publishing the list was intended to clarify movements that some users had mistaken for new malicious activity.
Staking added a difficult-to-reverse operation
Some of the funds were locked in staking. On Cosmos Hub, withdrawing delegated ATOM usually requires a 21-day waiting period called unbonding. Bitquery observed that the rescue movements avoided this wait by converting staked assets into tokens representing the stake that can be transferred.
Starting at 09:57 UTC on November 7, some operations grouped up to six wallets. In each one, the rewards address was changed to point to the recovery wallet, the stake was converted into a staking token, and that token was also transferred. Bitquery counted this procedure across 13,030 wallets. The conversion also released accumulated rewards worth approximately $251,000.
Staking tokens still require the 21-day period to be converted back into ATOM, unless a liquid staking service is used. Web3Auth has not explained how or when it will return these assets; it said some parts of the recovery are complex and may take time. The company did say that the transferred funds are safe and that it is working with Keplr to return them.
What Keplr users should do
Keplr recommends not sending new funds to an account created with Google or Apple and not importing or recreating it in another application. It also advises moving assets that are not staked or locked to a new wallet backed by a recovery phrase or a hardware wallet. Users who are unsure whether their account was affected should wait for the verification process Keplr is developing with Web3Auth.
Both companies have warned about fraudulent direct messages and recovery requests. Keplr asks users to follow only its official channels and those of Web3Auth. The access provider also published the addresses it says it uses for recovery, while warning that users should not assume any unfamiliar address is linked to the attacker.
Web3Auth has been part of Consensys since June 2025. When announcing the acquisition, Consensys said the deal would let MetaMask users create and recover wallets through social sign-ins. Following the Keplr breach, Web3Auth said its initial investigation had found no evidence that MetaMask users were affected; it has not provided further details about the potential impact on other services using its technology.
The recovery list covers the addresses Web3Auth has verified so far, and the company expects to expand it. It has yet to disclose how much the original attacker managed to move before the intervention or when the funds now in its custody will be available to their owners.
Sources: The Hacker News, Bitquery, TokenPost
