Web3Auth Moves $5.6M to Recovery Addresses After Keplr Login Flaw

Web3Auth, the authentication provider behind Keplr's social login feature, confirmed a security vulnerability that exposed private keys for some users who signed up with Google or Apple accounts, and moved roughly $5.6 million in assets to 12 emergency recovery addresses, The Block reported on November 8. The flaw sits with Web3Auth's login infrastructure, not with the Keplr wallet itself.

Keplr co-founder Josh Lee estimated that about 20% of accounts created through Google or Apple login were exposed to the vulnerability. The number actually drained by attackers appears smaller. Wallets secured by seed phrases or hardware wallets were not affected.

What actually happened to user funds?

Web3Auth contained the damage by moving assets out of at-risk wallets before attackers reached them. Those defensive transfers were at times mistaken for theft, as users saw balances drop without explanation. Keplr has told users that reduced or missing balances may reflect emergency transfers made to protect funds.

Blockchain analytics firm Bitquery initially estimated that about $6 million had been stolen from more than 44,000 Keplr wallets. That figure now looks overstated. All eight addresses Bitquery flagged as attacker-linked were in fact among Web3Auth's recovery addresses, meaning the "stolen" funds were mostly Web3Auth's own protective transfers.

The bulk of the recovered assets sits on the Cosmos Hub network. Web3Auth's recovery addresses hold approximately 2.49 million ATOM, worth about $3.3 million as of November 8. The exact amount attackers took, and the precise number of drained wallets, remain unconfirmed.

What should affected users do now?

Keplr's guidance to Google and Apple login users is direct:

• Do not deposit additional funds into existing wallets.
• Move any remaining assets to a new wallet secured by a seed phrase or a hardware device.
• Expect balance changes; some reflect emergency transfers to recovery addresses, not theft.

The advice effectively pushes social-login users back toward self-custody setups. For Keplr, that carries operational weight: the social login flow existed to onboard users who found seed phrases intimidating, and the incident undermines that convenience pitch.

Does the flaw reach MetaMask?

Web3Auth first disclosed the vulnerability on November 6 and temporarily suspended wallet creation through social login. The company said it found no evidence the same issue affects MetaMask users.

That matters because of ownership. Consensys acquired Web3Auth in June last year, and the service is now offered as MetaMask Embedded Wallets, powering key management inside MetaMask-linked applications. A confirmed spillover would have turned a niche Cosmos wallet incident into a mainstream trust problem for one of crypto's most-used wallet brands.

For now, the blast radius stays contained: one login provider, one wallet's user base, and a recovery operation still holding millions in user assets pending distribution. Web3Auth has not yet published a timeline for returning the $5.6 million to affected users, and Keplr has not said when social login wallet creation will resume.