Web3Auth Breach: 12 Recovery Addresses and an Unsettled $6M

By Daniel Okafor

Bitquery estimated that attackers drained at least $6 million from more than 44,000 wallets across eight Cosmos networks in the Web3Auth-linked breach affecting Keplr accounts created with Google or Apple sign-ins.

Web3Auth disclosed the incident on Nov. 6 as a provider-level issue, not a chain exploit, and paused its embedded-wallet service. An initial investigation found no evidence MetaMask users were affected.

Keplr named Web3Auth as its provider the next morning, paused Google and Apple logins, told users not to re-import affected accounts and said it had flagged unauthorized transactions to Web3Auth.

Keplr cofounder Josh Lee said: “This was not a hack of Keplr’s code.” He put the potentially affected group at about 20% of accounts created with Google or Apple login, but said only a fraction appeared exploited and the rest might be recoverable. Lee said other Keplr accounts, recovery phrases and hardware wallets were safe.

What do the 12 recovery addresses show?

Web3Auth began what it called whitehat recovery on Nov. 7, targeting “vulnerable but not yet impacted wallets utilizing the same path of the original attacker.” Its Nov. 8 list included 12 addresses, with 10 Cosmos-family entries sharing one secp256k1 key segment.

• The 10 Cosmos-family addresses carried the identical segment atuap9kfnt6y8ykvn3437e7j3z8qffh3, consistent with one secp256k1 public key rendered under different network prefixes.
• Injective used inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g, which does not share that segment and fits an Ethereum-derived 20-byte address.
• The final entry was an EVM address that Web3Auth said covered all eight EVM chains in scope.

The pattern is consistent with one recovery key across 11 networks, not 12 independent attacker wallets. It also explains why some Google/Apple-login accounts showed reduced or empty balances: a recovery transaction and a theft transaction look alike in an account history.

Which part of the key architecture failed?

MetaMask’s documentation for embedded wallets, now labeled formerly Web3Auth, says key shares span OAuth sign-in, trusted devices and recovery factors. It names Shamir’s Secret Sharing for dividing and reconstructing keys, with a core kit recombining shares after network validation of an identity token.

It says no single party, including MetaMask or a login provider, holds the full private key, preserving noncustodial control. Neither company has identified the failed link. Unconfirmed explanations include shares derivable from token validation, correlated share generation for some accounts, client-side threshold enforcement, or a compromised device plus a provider-side share.

Keplr omits key-rotation advice because social-login accounts give users no separate key. The confirmed outcome: accounts whose owners never recorded a seed phrase lost control of their keys.

The model is consolidating: Kraken’s parent acquired Magic Labs’ embedded-wallet business in July, putting more users behind fewer providers.

How much was actually stolen?

The $6 million Bitquery estimate averages about $137 per affected wallet across 44,000 addresses. That suggests either many small balances were swept, or the count included recovery-touched addresses rather than theft; neither reading supports describing 44,000 users as losing meaningful sums.

Coinpaper counted roughly $5.6 million across the 12 addresses on Nov. 8, including about 2.49 million $ATOM in the Cosmos Hub address. A Cosmos Hub node query at 23:51 UTC found no liquid uatom there; balances used a validator-operator share token across roughly 2,000 denominations. Recovery addresses are working accounts, not vaults, and balances move.

Web3Auth warned that some recovery sweeps had been mistaken for attacker activity. That overlap points to a final loss below $6 million, but the amount remained unpublished as of Sunday night.

What can affected users do now?

Keplr told users not to send new funds to affected accounts and to move remaining liquid assets into recovery-phrase or hardware-wallet accounts. It urged them to trust only updates from Keplr or @Web3Auth and to ignore direct messages or links offering recovery.

For staked, bonded or locked assets, including unbonding $ATOM and contract positions that one signature cannot move, Keplr said recovery was ongoing and would take longer, without a completion date.

Neither company has published a reconciled transaction list, and no independent party has matched the published addresses to the outflows they supposedly explain. Classification therefore rests on Web3Auth’s own attribution in the same week its infrastructure failed. The public recovery list also creates a ready-made fraud script.

That vendor-side exposure is not isolated: a Chainalysis breach earlier in November exposed live tokens for every user.

Did the breach drive $ATOM lower?

CoinGecko put $ATOM at $1.30 at 23:48 UTC on Nov. 8, down 5.2% over 24 hours. Bitcoin traded at $74,839, down 1.3%, and ether at $2,131, down 4.7%. Cosmos Hub validators continued producing blocks, and the disclosures provide no evidence linking the breach to those price moves.

The available evidence shows a broad market decline rather than a Keplr-specific shock; most $ATOM holders do not use the affected wallet infrastructure.

What would close the gap?

Four records would make the response auditable: a root-cause report, an expanded list of verified recovery addresses, and a reconciliation of staked and locked assets with a timetable. The fourth is an assurance from integrators beyond MetaMask’s initial finding and Trust Wallet’s statement that its users were untouched. Web3Auth has said it will add addresses as it confirms them.

The next checkpoint is the root-cause report and asset timetable; without them, social-login wallet users face an open-ended recovery wait as embedded-wallet providers consolidate.