Web3Auth Moves $5.6M From Keplr Wallets Hit by Key Flaw

About $5.6 million in digital assets now sits across 12 recovery addresses after Web3Auth moved balances out of Keplr wallets whose private keys were exposed by a flaw in Web3Auth's service, according to on-chain records of those addresses.

The wallets involved are Keplr accounts created with Google or Apple sign-in, which delegate key handling to Web3Auth rather than holding keys the user generated and backed up themselves. Web3Auth said it swept those balances into recovery addresses, placing about $5.6 million in crypto "under recovery control." That is a containment step, not a disclosure of what attackers took.

What sits in the addresses is only partly itemized:

• Roughly 2.49 million ATOM, the Cosmos Hub's native token, worth about $3.3 million — close to 59 percent of the $5.6 million balance.
• About $2.3 million in other digital assets, by subtraction from the $5.6 million total, none of which the source itemizes.
• An average of roughly $467,000 per address across the 12 recovery addresses, though no per-address balances have been published.

Concentration cuts both ways. Most of the recovery balance rides on one token on one chain, so the dollar value of what users eventually get back moves with ATOM's price rather than with any fresh inflow. The bigger issue is definitional: $5.6 million is what the addresses hold after the transfers, not what the exposed wallets held before them, and not a loss estimate.

How much moved, and how much disappeared?

Web3Auth has referred to an "original attacker" without naming the actor, and the amount stolen before its transfers remains undisclosed. Address balances document the custody change, not the theft. Readers who take the $5.6 million as a loss figure would be reading it wrong; the accurate description is a balance now under recovery control.

Keplr co-founder Josh Lee put the scope of the exposure in numbers: he estimated "about 20% of accounts created with Google or Apple login were affected," while saying only a small fraction had actually been exploited. His estimate counts accounts touched by the flaw, not confirmed thefts, and the two figures shouldn't be merged.

What does the 20% estimate settle — and what doesn't?

It settles blast radius on the social-login cohort: roughly one in five Keplr accounts built that way had keys exposed, even if most were never drained. It settles nothing about money. The multiplier between affected accounts and exploited accounts is unknown, no stolen total has been published, and no timeline has been disclosed for when the keys were exposed or when the transfers occurred.

For the affected cohort, the operational consequence is a custody migration: balances that sat in compromised wallets now sit in vendor-controlled recovery addresses, with the mechanism for returning them to users left unspecified in Web3Auth's account of the action. For the wider market, the episode concentrates key risk in a service provider's infrastructure, and it puts the disclosure burden on that provider rather than on the wallet brand alone.

The next hard evidence will be on-chain rather than on the newswire: movement out of the 12 recovery addresses would show whether the recovery process is beginning to distribute or still consolidating, and only a confirmed loss figure will close the gap between the 20% exposure estimate and what was actually taken. Until then, treat $5.6 million as the balance now under recovery control and the theft as undisclosed.