Web3Auth Flaw Exposed Keplr Google and Apple Login Keys; Provider Says It Moved $5.6 Million to Recovery Wallets

Some people who set up a Keplr crypto wallet through a Google or Apple account have had money stolen. The cause, according to both Keplr and Web3Auth, is a security flaw at Web3Auth, the company that generates and manages the keys behind those logins. Keplr has suspended Google and Apple sign-in while it investigates.

Web3Auth disclosed a security issue in its infrastructure on Friday, Nov. 6. By early Saturday, Keplr was reporting unauthorized transactions and disabled both login methods. Keplr called it a "private key breach" for some social-login users. A private key is the secret that approves payments from a wallet, so whoever holds it can move the money.

Keplr co-founder Josh Lee said the wallet's own code was not hacked. His early estimate was that about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited.

Who is exposed

Wallets created with a recovery phrase (the 12- or 24-word backup) or a hardware device are not affected, Keplr said. Social-login accounts work differently. They rely on third-party key infrastructure rather than a phrase the user holds.

Keplr is telling affected users to stop sending funds to those accounts. It also wants them to move any remaining liquid assets to a recovery-phrase or hardware-wallet account.

The rescue operation

The complication is that an empty wallet does not necessarily mean a stolen wallet. Web3Auth said its partners, with Keplr's help, began "whitehat recovery activities" on vulnerable wallets the attacker had not yet reached. The company described the method as "utilizing the same path of the original attacker."

The funds went into recovery wallets Web3Auth controls. It published 12 addresses on Nov. 8 so users can tell its transfers from malicious ones. On-chain data shows those addresses hold about $5.6 million, including roughly 2.49 million ATOM on Cosmos Hub, worth about $3.3 million.

Many of the coins were staked. To avoid the 21-day unbonding wait, the recovery team swapped them for liquid tokens that could move immediately. Web3Auth said the rescued funds are safe and will be returned to their owners.

Web3Auth also warned users not to assume an unfamiliar destination address belongs to the attacker.

What the blockchain data shows

Bitquery, a blockchain analytics firm, first reported more than $6 million stolen. Its count covered at least 44,041 addresses across seven Cosmos-ecosystem chains and 7,603 on Injective. After overlaps, that comes to about 44,700 unique wallets.

By chain, Cosmos Hub accounted for about $3.50 million, Osmosis $1.04 million and Injective $615,000. The median wallet moved just $1.34. The largest single transfer was close to $325,000.

Bitquery's data shows the first of these transfers came 21 minutes before Web3Auth's first public notice. About 86% of the wallets on seven linked networks were emptied after Keplr's initial warning. That timing fits a rescue effort as much as it fits theft.

Bitquery has since issued a corrected analysis treating the transfers as recovery activity. The Block reported that all eight addresses Bitquery had tied to the attacker appear on Web3Auth's list. Bitquery says it cannot verify who controls the recovery wallets. For now, the claim that the rescued funds are safe rests on Web3Auth's word.

Bitquery also documented about 1.96 million staked ATOM moving without the usual 21-day wait, through liquid staking tokens. About $251,000 in staking rewards was redirected.

How much was actually stolen

Nobody has put a confirmed number on it. Web3Auth referred to "the original attackers," which indicates some wallets were drained before the rescue began, but it has not said how many wallets or how much money. Neither company has issued a dollar figure.

GoPlus, a Web3 security firm, said in a security alert that at least about $1 million had been stolen. It did not explain how it reached that number.

The companies have also left out how the flaw worked, when the attacker first used it, and whether that route is now closed. Web3Auth, which is owned by Consensys, has given no technical detail on how its recovery team reached the funds.

What users should do now

Keplr says staked and locked assets "add complexity and take longer" to secure, and it has given no timetable. It is working with Web3Auth on a way for users to check whether their account was affected.

Until then, users can compare any outgoing transfer's destination against Web3Auth's published recovery addresses. Keplr warned that mitigation could leave accounts with reduced or empty balances. Checking the outgoing transactions is the only way to tell how much, if anything, was taken.

The open questions are concrete. Web3Auth has not said what the flaw was, how many wallets the original attacker emptied, or when staked users will see their funds returned.