Web3Auth Moves Keplr Incident Assets Into Verified Recovery Wallets

Web3Auth has begun moving assets affected by the Keplr wallet security incident into recovery wallets, publishing verified destination addresses as the transfer work continues. The company confirmed the operation is ongoing and said it will keep the address list updated until every affected asset is matched with a verified destination.

The announcement centers on coordination between two companies: Web3Auth, the key-infrastructure provider, and Keplr, the Cosmos-ecosystem wallet. Affected assets are being transferred into designated recovery wallets. Web3Auth is the party publishing the verified addresses, and it has committed to maintaining that list as the recovery proceeds.

For users caught in the incident, the practical guidance is narrow. Information should come only through official channels. Recovery destinations should be checked only against the verified-address list that Web3Auth maintains. Anything else carries risk.

What does this change for affected users?

The change is procedural, but it matters. Before this update, users affected by the Keplr incident had no consolidated, verified reference for where their assets would end up. Now there is one. Web3Auth says it will update the address list continuously, so that affected assets can be matched with destinations verified for the recovery process.

That still leaves work for the user. They need to identify the official channels, find the current version of the address list, and confirm any destination address against it before acting. The list is the source of truth. A recovery destination not on the list should be treated as suspect.

Why the impersonation warning?

Web3Auth paired the recovery announcement with an explicit caution. Users should stay alert for impersonators and fraudulent requests claiming to help recover funds. This is the standard follow-on risk in any incident recovery: the moment a process is announced publicly, scammers imitate it.

The company's warning is direct on this point. Rely on official channels. Watch for impersonation attempts. Treat unsolicited offers of recovery assistance as fraudulent unless they can be verified against the published addresses and official communications.

The operational logic here is straightforward. A verified-address list only protects users if they actually check it. An impersonator's pitch fails the moment a user compares the address they were given against the published list and finds no match. That comparison is the defense.

What happens next?

The transfers remain in progress, and Web3Auth has framed the address list as a living document rather than a one-time publication. The company plans to keep updating it as the recovery advances, which implies additional addresses may appear as more affected assets are matched to verified destinations.

For now, the burden on users is vigilance. The recovery infrastructure is being built out in public, which is both its strength and its exposure. Users who stick to official channels and the verified-address list are positioned to follow the process to its conclusion. Those who act on unsolicited messages are not.