Web3Auth moves $5.6 million from exposed Keplr wallets

Did Web3Auth move exposed Keplr wallet funds before an attacker could reach them? The company says it swept vulnerable Google- and Apple-login wallets into recovery addresses, which held about $5.6 million when The Block reported the recovery on November 8. The key caveat: Web3Auth has not said how much an original attacker took.

Which Keplr accounts did the recovery affect?

The issue affected some Keplr wallets created through Google or Apple sign-in, which rely on Web3Auth’s embedded wallet service. Keplr co-founder Josh Lee estimated that about 20% of those social-login accounts were affected, while recovery-phrase and hardware-wallet accounts were not. Keplr said the incident originated in Web3Auth’s systems, not in Keplr’s wallet code.

Web3Auth said it began sweeping vulnerable wallets that the attacker had not reached, using “the same path of the original attacker.” The company described the process as a whitehat recovery and said the funds were safe and it was working with Keplr on returning them. It also published 12 recovery addresses.

Does the $5.6 million figure mean that much was stolen?

No: the figure refers to assets held in the recovery addresses, not a confirmed attacker loss. Bitquery’s on-chain analysis found about $6.01 million in those addresses at its November 7 prices, tracing transfers from at least 44,041 wallets across seven Cosmos chains and additional Injective wallets. Bitquery says the recovery addresses include the ones it first attributed to a thief, but neither company has identified an original attacker wallet or stated the amount stolen.

On Cosmos Hub, the recovery address held about 2.49 million ATOM, worth roughly $3.3 million in The Block’s account. Much of it had been staked; the recovery converted it into tokens that could move immediately instead of waiting through Cosmos Hub’s 21-day unstaking period. The on-chain figures therefore describe recovered funds and their movement, not a final tally of losses.

What should affected users watch for next?

Keplr advised Google- and Apple-login users not to send more funds to those accounts and to move any remaining assets to a wallet secured by a recovery phrase or hardware device. The companies said they were working on a way for users to check whether their accounts were affected and on a recovery path. Watch for their official updates on that account check and the return process; no date for either has been announced.

References

• The Block reported the recovery on November 8 — theblock.co
• Bitquery’s on-chain analysis — bitquery.io