A Keplr wallet hack hit users who created their wallets through Google or Apple logins. Web3Auth now says several addresses flagged as attacker wallets are its own recovery wallets.
The difference matters for thousands of Cosmos users. On-chain data firm Bitquery tied more than $6 million to the drain. However, part of that sum may now sit in wallets Web3Auth holds for safekeeping.
How the Keplr Wallet Hack Hit Social Login Users
Web3Auth provides login tools that let apps create crypto wallets through social accounts. On November 6, the company paused its embedded wallet service and put its login service into maintenance.
Initially, the company reported no sign of impact on MetaMask users, who faced a separate security incident in October. A day later, Web3Auth traced the flaw to its own infrastructure and confirmed that it hit some Keplr wallets.
Keplr then disabled Google and Apple sign-ins. Accounts created with a recovery phrase or a hardware wallet face no risk, the wallet team says.
Bitquery counted roughly 44,700 affected Keplr wallets across eight Cosmos-based chains. The largest single loss reached about $325,000.
The incident hit an ecosystem that already saw disruption this year. In spring, the Leap Wallet shutdown pushed many Cosmos users toward Keplr.
Rescue or Theft? Why the Addresses Matter
Meanwhile, Web3Auth says it started a whitehat operation with its partners. The team moved funds out of vulnerable wallets before the attacker reached them, using the same access path.
Some observers mistook those transfers for part of the Keplr wallet hack. In response, Web3Auth published verified addresses on Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM chains.
Several of these addresses share a key with collector wallets that Bitquery had linked to the drain. Web3Auth has not said how much of the tracked total it secured.
Recovered funds are safe, Web3Auth says, and the team is working with Keplr on a way to return them. It also warned about impersonators who offer fake recovery help.
Other projects moved to calm users. PancakeSwap, for example, said its funds and smart contracts remain safe.
The Keplr wallet hack adds to a heavy year for crypto security. North Korean hackers alone took $7.61 billion in 2026. Separately, an attacker recently emptied over 1,400 Qubic wallets.
