Web3Auth Recovery Addresses Received $6 Million From More Than 50,000 Keplr Wallets

An updated tally counts more than 50,000 Keplr social-login wallets in a Web3Auth recovery effort that moved about $6.01 million after private keys were exposed.

At least 44,041 wallets across seven Cosmos chains and 7,603 on Injective had assets sent to addresses Web3Auth published for recovery. For the wallets counted, the median transfer was $1.34; 88% moved less than $100, while the largest transfer came to $325,000.

The $6.01 million represents assets moved into those addresses, not confirmed losses. The amount taken by the original attacker remains undisclosed.

Web3Auth disclosed a security issue in its embedded-wallet service, which powers Keplr accounts created through Google or Apple sign-in. Keplr co-founder Josh Lee said Keplr’s own code was not compromised and traced the issue to Web3Auth.

Web3Auth described its transfers as a white-hat rescue of vulnerable wallets that had not yet been attacked. Keplr paused social sign-ins and said accounts created with a recovery phrase or hardware wallet were unaffected. Keplr and Web3Auth are developing a tool for users to check whether their accounts were affected.