Some transfers following the Keplr wallet breach were recovery operations, not further theft, Web3Auth and Keplr confirmed on November 8. Web3Auth published verified recovery addresses for assets it has been moving out of affected accounts, including the destination of a batch involving 2,265.59 staked ATOM from six Cosmos Hub accounts.
Key takeaways
Keplr confirmed Web3Auth’s listed wallets as authorized recovery destinations.
Recorded transfers worth $6.01 million do not represent confirmed theft losses.
Recovery-phrase and hardware-wallet accounts remain unaffected, Keplr says.
Keplr wallet breach recovery addresses identify protective transfers
Web3Auth said it is moving exposed assets into secure wallets with Keplr’s assistance. Some protective transfers had been mistaken for attacker activity because recovery teams used the same technical route exploited during the incident.
Among the chains included in the verified list are Cosmos Hub , Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, alongside a single recovery address shared by eight EVM-compatible chains.
The Cosmos Hub destination received share tokens from a November 7 transaction that tokenized stake held across six accounts . The Hub’s liquid staking module makes delegations transferable while the underlying ATOM remains bonded. It bypasses the 21-day unbonding period for transferring those claims; the transaction did not convert the stake into immediately spendable ATOM.
Bitquery traced approximately $6.01 million in transfers associated with the November 6–7 incident. Its investigation counted 44,041 wallets across seven Cosmos networks and 7,603 addresses on Injective , estimating roughly 44,700 distinct affected wallets after accounting for overlap.
Destinations associated with approximately $3.5 million on Cosmos Hub and $1.04 million on Osmosis matched Web3Auth’s recovery wallets. The transfer total therefore cannot automatically be classified as stolen funds.
Bitquery also identified transfers involving 1.96 million staked ATOM. Approximately 86% of affected wallets on the seven linked networks recorded outgoing transfers after Keplr’s initial warning.
Web3Auth vulnerability exposed some social-login accounts
Keplr attributed the breach to a Web3Auth infrastructure vulnerability that exposed private keys belonging to some social-login users. It suspended Google and Apple login after receiving reports of unauthorized transactions.
Keplr co-founder Josh Lee said the incident did not originate in Keplr’s wallet code. He estimated that roughly 20% of its Google- and Apple-login accounts were potentially affected, while only a fraction had been exploited.
Web3Auth temporarily suspended its embedded wallet service. Keplr said recovery-phrase and hardware-wallet accounts were unaffected. Web3Auth reported no evidence of an impact on MetaMask users, while Trust Wallet representative Felix said Trust Wallet was unaffected.
Keplr directs social-login users to move liquid assets
Keplr’s November 7 guidance told Google- and Apple-login users to stop depositing into those accounts and to transfer remaining liquid assets to accounts secured with a recovery phrase or hardware wallet.
Users were also told to ignore unsolicited direct messages and links offering recovery services, and to rely on official Keplr and Web3Auth updates.
Keplr warned that recovery measures can leave affected social-login wallets showing reduced or empty balances. Staked and locked assets take longer to secure. The teams are also working on a way for customers to determine whether their accounts were affected.
Web3Auth said it would add further recovery addresses to its published list as verification continues.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
