Web3Auth has successfully secured $5.6 million from vulnerable Keplr wallets, averting further losses from a detected security breach.
Web3Auth has successfully moved approximately $5.6 million from compromised Keplr wallets to secure addresses, preempting further theft. The company, which is part of ConsenSys, announced the asset recovery in response to a security incident that impacted certain wallets accessed via Google and Apple accounts.
Update on Keplr asset recovery:
As part of our ongoing response to the security incident affecting certain Keplr wallets, we have been transferring assets into secure recovery wallets, with assistance from Keplr.
— Web3Auth (@Web3Auth) November 8, 2026
The vulnerability was identified in the infrastructure of Web3Auth, leading to unauthorized access to private keys for some users. Josh Lee, co-founder of Keplr, clarified that the wallet's core code was not compromised, indicating that the issue affected roughly 20% of accounts created through Google or Apple, although only a fraction were exploited.
Wallets created using a seed phrase or hardware devices remained unaffected. Following the attack, Web3Auth disabled its built-in wallet service on November 6, and began transferring assets the next day by accessing the vulnerable accounts similarly to the attackers.
On November 8, the firm published a list of 12 recovery addresses, with the most significant amount recovered coming from Cosmos Hub, totaling about 2.49 million ATOM valued at $3.3 million. Many of these tokens were in staking, but to expedite recovery, the team converted them into liquid tokens for immediate transfers.
Response to the Incident
As reported by Bitquery on November 7, over $6 million was stolen from more than 44,000 Keplr wallets across several blockchains, with investigations identifying around 44,700 unique compromised wallets. However, Web3Auth's recovery efforts revealed that some transactions attributed to hackers were part of the recovery process.
While the exact loss from the attack remains unclear, Web3Auth acknowledged the existence of an initial attacker but did not disclose specific figures regarding the number of wallets emptied or total funds stolen. The firm reassured that the recovered assets are safe and is collaborating with Keplr to return them to their rightful owners, although no timeline has been provided yet.
Keplr advised users who accessed their wallets via Google or Apple to refrain from adding funds and to transfer any remaining assets to wallets secured with seed phrases or hardware protection. The company also warned of potential scams targeting users seeking recovery assistance.
