Web3Auth Publishes Verified Keplr Recovery Addresses to End Attacker Confusion

Web3Auth has published a verified list of recovery-wallet addresses tied to the Keplr wallet security incident, and it says every transfer on that list belongs to the recovery effort — not to an attacker. The disclosure covers 11 named networks: Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric. It also includes Ethereum Virtual Machine addresses spanning eight chains.

The move is a housekeeping step in an active recovery. Web3Auth is working with Keplr to move assets out of affected wallets and into secure recovery wallets. But some of those transfers were mistaken for attacker activity by onlookers tracking the wallets. That confusion is what prompted the company to publish the addresses in the first place.

Web3Auth described the published addresses as verified and said it will add more to the list as further addresses are confirmed. The clarification, the company stressed, applies only to the addresses it has already checked. The verification work continues alongside the recovery itself.

What does this change for users?

For anyone watching chain explorers, the practical answer is straightforward. If a transfer from an affected Keplr-linked wallet lands on one of the published addresses, Web3Auth says it is part of the asset-securing operation, not evidence of ongoing exploitation. Users checking movements on Cosmos Hub, Osmosis, Celestia or any of the other listed networks now have an authoritative reference point.

The company also flagged a second risk that grows whenever recovery operations become public: social engineering. Web3Auth urged users to follow official channels for updates and to watch for people impersonating staff or making false requests to recover assets.

Why publish addresses at all?

Recovery operations live or die on transparency. When a security team moves funds from compromised wallets, on-chain observers see the transfers in real time. Without a published address set, analysts and affected users have no way to distinguish a rescue from a second round of theft. The published list turns ambiguity into something checkable, address by address, across every chain involved.

The scope hints at the breadth of the incident. Eleven Cosmos SDK-based networks are named individually, because assets on each chain sit at distinct addresses. The eight EVM chains are covered separately through Ethereum-style addresses. That is a wide footprint for any single recovery, and it explains why Web3Auth is releasing the list incrementally rather than all at once.

For now, the burden of verification sits with the user. Web3Auth's guidance is to treat the published addresses as the canonical record, ignore unsolicited recovery offers, and expect the list to grow as the operation proceeds and more addresses clear verification.