Web3Auth moves $5.6 million from exposed Keplr wallets after private key flaw

Traders Union
All News
Crypto
Web3Auth moves $5.6M from Keplr

Highlights

Web3Auth moves $5.6 million from vulnerable Keplr wallets after a private key flaw exposes accounts created with Google or Apple sign-ins.
Keplr co-founder estimates around 20% of the platform’s Google and Apple login accounts are affected, though most wallets with recovery phrases or hardware security remain unaffected.
Blockchain analysis finds over 44,000 wallets compromised for about $6 million, but some flagged thefts are linked to Web3Auth’s emergency recovery as opposed to malicious actors.

Recovery operation follows social login exposure

As reported by The Block, Web3Auth says it begins moving funds out of vulnerable Keplr wallets after a flaw in its service exposes the private keys of some users who signed up with Google or Apple accounts.

Web3Auth, which is owned by Consensys and provides the social sign-in layer for Keplr, says the recovered assets are safe and that it is working with Keplr on returning them. The company also refers to an "original attacker," indicating that some wallets are hit before the recovery effort starts, though it does not say how many wallets are affected or how much is stolen.

Keplr co-founder Josh Lee says the incident does not stem from Keplr's own code and estimates that about 20% of Keplr's Google and Apple login accounts are affected. Keplr says users who set up wallets with a recovery phrase or a hardware wallet are not affected.

Web3Auth says on Saturday that it starts emptying wallets the attacker has not yet reached, using what it describes as the same path as the original attacker. Early Sunday, it publishes the recovery addresses after some transfers are mistaken for theft activity.

Onchain data reviewed by The Block shows the 12 recovery addresses hold about $5.6 million at publication time on Sunday. Most of the recovered funds are on Cosmos Hub, where one recovery address holds about 2.49 million ATOM worth roughly $3.3 million; much of that ATOM had been staked and is converted into tokens that can be moved immediately instead of waiting through the network's 21-day withdrawal period.

Crypto wallet users face transfer and account checks

Blockchain analytics firm Bitquery reports on Saturday that a thief collects about $6 million from more than 44,000 Keplr wallets, but all eight addresses it links to the thief appear on Web3Auth's recovery list. That overlap suggests at least part of the activity initially flagged as theft is tied to the mitigation effort.

Lee says many vulnerable accounts may still avoid losses and that only a fraction of the exposed 20% appears to be exploited. Keplr warns, however, that some accounts may already show reduced or empty balances because of the emergency transfers.

Keplr tells users who rely on Google or Apple login not to send more funds to those accounts and advises them to move any remaining assets to wallets secured by a recovery phrase or hardware device. The company says it is working with Web3Auth on a way for users to verify whether their accounts are affected.

Web3Auth first discloses the issue on Friday afternoon and pauses the service that lets apps create wallets through social logins. It says it finds no evidence that MetaMask users are affected; Consensys acquires Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets in its developer documentation.

Cohere’s planned acquisition of AISLE highlights how AI firms are pushing deeper into cybersecurity by using AI to detect software vulnerabilities. Our earlier article noted that AISLE’s tools uncovered hundreds of new bugs in widely used software, including multiple OpenSSL vulnerabilities that were fixed after discovery, underscoring how vulnerability research can reduce downstream security incidents.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.