Web3Auth disputes $6.01M Keplr theft figure, says funds moved to recovery wallets
In brief
- Web3Auth calls the circulating $6.01 million Keplr theft estimate false, citing transfers to recovery wallets.
- A Web3Auth flaw hit Keplr users who signed in with Google and Apple accounts.
- Bitquery tracked more than 44,041 affected Cosmos wallets and 7,603 on Injective.
- Keplr says wallets set up with recovery phrases or hardware devices weren't compromised.
What happened
Funds started draining from Keplr wallets tied to social logins over November 6 and 7, 2026. Web3Auth confirmed the vulnerability on November 6 and paused its embedded wallet service the same day.
It's a big footprint. Bitquery, a blockchain data provider, tracked more than 44,041 affected wallets in the Cosmos ecosystem and another 7,603 on Injective (a Cosmos-based chain), according to the report.
Keplr co-founder Josh Lee said the breach came from a flaw in Web3Auth's services and affected roughly 20% of wallets created through Google and Apple logins. According to Keplr, accounts set up with recovery phrases or hardware devices weren't compromised.
Why the number is in dispute
The $6.01 million figure is an unverified estimate, and it isn't clear where it originated. It was reportedly put together by tallying funds that flowed out of affected wallets during the incident window. Web3Auth says that method has a blind spot.
Web3Auth said some on-chain movements labeled as theft were protective whitehat recoveries carried out by the company and its partners. Those recovery operations used the same technical routes as the initial attacks, so for anyone watching the blockchain, a rescue and a theft look nearly identical.
By November 8, Web3Auth had published a list of verified recovery addresses covering eleven Cosmos-based networks and eight EVM-compatible chains.
LeoDex News couldn't independently confirm how much was stolen versus recovered.
What users are being told
Both Web3Auth and Keplr told users to ignore any unofficial recovery offers and to rely only on the companies' own channels. Keplr also advised users to stop depositing new funds into affected accounts and to move their assets to secure accounts.
The setup itself is worth understanding. With social-login wallets, users sign in with a Google or Apple account while a third-party provider (Web3Auth, in this case) handles the key management behind the scenes, which is why a flaw in that one provider's services reached Keplr users across so many chains.
Frequently asked questions
Why does Web3Auth dispute the $6.01 million Keplr theft figure?
Web3Auth said the estimate was false because the funds moved to verified recovery wallets, not to an attacker. It said some on-chain movements labeled as theft were whitehat recoveries by Web3Auth and its partners, which used the same technical routes as the attacks. LeoDex News couldn't independently confirm how much was stolen versus recovered.
Which Keplr wallets were affected by the Web3Auth vulnerability?
The flaw hit Keplr users who signed in with Google and Apple accounts. Keplr co-founder Josh Lee said it affected roughly 20% of wallets created through those logins. According to Keplr, accounts set up with recovery phrases or hardware devices weren't compromised.
What should affected Keplr users do?
Web3Auth and Keplr told users to ignore unofficial recovery offers and use only the companies' own channels. Keplr also advised users to stop depositing new funds into affected accounts and to move assets to secure accounts.
