Keplr Confirms Recovery Addresses After Web3Auth Breach

Keplr confirmed verified recovery addresses for 11 Cosmos-ecosystem networks and one EVM address after a Web3Auth infrastructure vulnerability exposed private keys for some social-login users, according to Keplr’s post and Web3Auth’s recovery updates.

The Nov. 8 publication extends Nov. 7 guidance, when Web3Auth was still preparing a verified list and told users not to assume unfamiliar destinations belonged to an attacker. The guidance asked users to distinguish confirmed destinations from unverified transfer requests while direct messages and links could still solicit transfers.

Which networks are covered?

The confirmed list covers:

• Cosmos Hub
• Osmosis
• Celestia
• Akash
• Noble
• Injective
• dYdX
• Babylon
• Axelar
• Saga
• Agoric
• An EVM address

Keplr’s embedded post carries the full addresses. That verification step matters because a copied destination in a private message does not establish the same status as an address checked against both teams’ published lists.

What happened to the 2,265.59 staked ATOM?

The confirmed Cosmos Hub address also received the Nov. 7 batch that moved staking claims from six accounts. According to The Defiant’s calculation and review of the onchain record, the transaction tokenized 2,265.59 staked ATOM and transferred the resulting share tokens to the listed address.

The destination’s role was unresolved in The Defiant’s earlier report. It now appears on both teams’ recovery-address lists, providing the confirmation that the Nov. 7 instruction required.

The 2,265.59 ATOM figure is specific to that six-account batch; it is not the teams’ total of assets secured, which the Nov. 8 updates did not quantify.

Cosmos Hub’s liquid staking module turns delegations into transferable claims while the underlying ATOM stays bonded. Those claims can move without waiting through a 21-day unbonding period. The batch therefore moved the transferable claim rather than turning the stake into immediately spendable ATOM.

For affected users, that technical distinction defines the recovery outcome. A liquid balance can move under Keplr’s Nov. 7 instruction. A staking claim can also transfer without the 21-day wait, but its recipient still does not hold immediately spendable ATOM because the underlying delegation remains bonded.

What should social-login users do?

Keplr paused Google and Apple login after reports of unauthorized transactions. It later attributed the incident to a Web3Auth infrastructure vulnerability that exposed private keys for some social-login users. Keplr said accounts created with a recovery phrase or hardware wallet were unaffected.

In its Nov. 7 guidance, Keplr told Google- and Apple-login users “not to send new funds to those accounts” and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. Keplr also warned users to “ignore direct messages or links offering recovery” and trust only official updates from Keplr and Web3Auth.

The instructions divide the response into liquid and non-liquid positions. Users with liquid balances received a destination and transfer instruction. Users with staked or locked assets still face a longer process; Keplr said those holdings take more time to secure.

The teams’ Nov. 8 address updates did not quantify the assets secured or provide a process for returning them to users.

Web3Auth said it would expand the list as additional addresses are verified. The recovery window remains open-ended because Web3Auth’s next step is additional address verification, while staked and locked positions still depend on a return process that the Nov. 8 updates did not specify.