Web3Auth Rescue Swept $6 Million From 50,000-Plus Keplr Wallets

Web3Auth's recovery operation moved roughly $6.01 million from more than 50,000 Keplr social-login wallets after an exposure of private keys in its embedded-wallet service, an updated on-chain tally shows.

The count, first reported by The Block, breaks down into 44,041 wallets across seven Cosmos chains and 7,603 wallets on Injective. All of those accounts had assets sent to recovery addresses Web3Auth published after it disclosed the security issue.

How big were the transfers?

The distribution skews heavily toward small balances. For the wallets counted, the median transfer came to $1.34. Some 88% of the moved amounts were under $100. At the top end, the largest single transfer reached $325,000.

The $6.01 million figure represents assets moved into Web3Auth's published recovery addresses — not confirmed losses. Web3Auth framed the transfers as a white-hat rescue of wallets that were vulnerable but had not yet been drained by an attacker.

The amount actually taken by the original attacker remains undisclosed. That gap matters: the headline number measures the rescue, not the theft, and neither company has quantified user losses so far.

What caused the incident?

Web3Auth disclosed a security flaw in its embedded-wallet infrastructure, the service that powers Keplr accounts created through Google or Apple sign-in. Keplr co-founder Josh Lee said Keplr's own code was not compromised and traced the issue to Web3Auth's side of the stack.

That distinction carries operational weight. Keplr accounts created with a standalone recovery phrase or a hardware wallet were unaffected by the exposure. The blast radius was limited to users who outsourced key management to social-login flows.

What did Keplr do next?

Keplr paused social sign-ins as a containment step. It's a blunt but effective move: it blocks new sessions from relying on the compromised pathway while remediation continues.

Keplr and Web3Auth are now building a tool that lets users check whether their specific accounts were affected. No release date has been announced for that checker, which leaves affected users dependent on the recovery-address process in the meantime.

Why this matters for wallet infrastructure

The incident exposes the structural trade-off in embedded wallets. Social logins lower the barrier to onboarding, but they concentrate key custody in a third-party service — and when that service fails, the failure is systemic rather than isolated to one user's mistake.

For the Cosmos and Injective ecosystems, the numbers are also a gauge of how much retail activity flows through custodial-adjacent login flows: more than 50,000 accounts, most holding under $100, but enough aggregate value — over $6 million — to make the recovery mechanism worth the operational disruption.

The unresolved question is the attacker's actual haul. Until Web3Auth or Keplr discloses confirmed theft figures, the market can't size the damage separately from the rescue. Expect scrutiny to stay on both firms until the account-checker ships and the loss figure is made public.