TheBlock
Web3Auth says it frontran an attacker by emptying vulnerable Keplr wallets before the hacker could reach them, moving about $5.6 million in crypto into 12 recovery addresses, according to onchain data reviewed by The Block. The incident traces to a flaw in Web3Auth's systems that exposed the private keys of Keplr users who signed up with a Google or Apple account. Keplr co-founder Josh Lee estimates roughly 20% of the wallet's Google and Apple login accounts were affected, while blockchain analytics firm Bitquery reported a thief collected about $6 million from more than 44,000 wallets before the recovery began.
Why it matters
The breach did not touch Keplr's code. It originated at Web3Auth, the Consensys-owned provider that powers the wallet's social sign-in, turning a single infrastructure vendor into a point of failure for millions of keys. Keplr says it passed 2 million users and now supports EVM networks beyond its original Cosmos home, which widens the blast radius. Web3Auth found no evidence that MetaMask users were affected, but Consensys now markets the same service as MetaMask Embedded Wallets, so the industry will be watching how the firm hardens the product.
Market impact
Much of the recovered funds sit on Cosmos Hub, where a recovery address holds about 2.49 million ATOM, worth roughly $3.3 million. The sweeps converted staked ATOM into liquid tokens rather than waiting out the network's 21-day withdrawal period, putting a sizable balance in movable form. Keplr has told Google and Apple login users not to send funds to their accounts and to move anything remaining to a recovery-phrase or hardware wallet. Web3Auth has not said how many wallets the attacker hit or how much was taken, leaving the true loss unclear as the two firms build a tool for users to check exposure.
Frequently asked questions
-
Were all Keplr wallet users affected by the Web3Auth flaw?
No. Only users who signed up with a Google or Apple account through Web3Auth were exposed. Keplr users who set up with a recovery phrase or a hardware wallet are not affected.
-
How much did the attacker steal from Keplr wallets?
Web3Auth has not said how many wallets the attacker hit or how much was taken. Bitquery reported a thief collected about $6 million from more than 44,000 Keplr wallets, and Web3Auth recovered roughly $5.6 million from wallets the attacker had not yet reached.
-
What should affected Keplr users do now?
Keplr has told Google and Apple login users not to send any funds to their accounts and to move any remaining funds to a wallet secured by a recovery phrase or a hardware device.
-
Where are the recovered funds being held?
The recovered funds sit across 12 addresses published by Web3Auth, with the largest holding about 2.49 million ATOM on Cosmos Hub, worth roughly $3.3 million. Web3Auth says it is working with Keplr on a path to recovery for users.
-
Was MetaMask affected by the Web3Auth incident?
Web3Auth said it found no evidence that MetaMask users were affected. Consensys acquired Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets.
CryptoSlate
WuBlockchain
Crypto Capital Venture
WatcherGuru
CoinDesk
Glassnode