Web3Auth Moved $5.6 Million to Safety Before Hackers Could Reach Exposed Keplr Wallets

Published November 9, 2026, 1:20 AM PKT. Based on reporting from The Block (primary source), Web3Auth statements, Bitquery on-chain analysis, and Cryptonomist.

Web3Auth, the Consensys-owned login provider behind Keplr's Google and Apple sign-in, said it used the same flaw that exposed users' private keys to move about $5.6 million into 12 recovery wallets before attackers could reach it, turning part of a wallet drain into a rescue operation. The Block reported the recovery on November 8, 2026, citing on-chain data it reviewed, which showed the 12 addresses held about $5.6 million in crypto at the time of publication.

The rescue changes the shape of an incident MABOnChain covered on November 7 and November 8, when Keplr paused social logins and then confirmed that a Web3Auth flaw had exposed the private keys of some users who signed up with a Google or Apple account. Blockchain analytics firm Bitquery had reported on November 7 that a thief collected about $6 million from more than 44,000 wallets, but Web3Auth said on November 8 that some of the transfers counted in that figure were its own recovery moves, not theft.

The $5.6 million rescue

Web3Auth said on November 7 that it had started emptying vulnerable wallets the attacker had not reached yet, using "the same path of the original attacker", according to The Block. "Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users," Web3Auth said. Early on November 8, Web3Auth published a list of verified recovery addresses, and said it was aware some of those transactions had been mistaken for attacker activity.

The reference to an "original attacker" confirms that some wallets were drained before the recovery began, The Block noted. Web3Auth has not said how many wallets the attacker hit or how much was taken, and it did not immediately answer The Block's request for further information.

Most of the recovered funds sit on Cosmos Hub. Web3Auth's recovery address there holds about 2.49 million Cosmos ($ATOM), worth roughly $3.3 million, according to on-chain data reviewed by The Block. Much of that Cosmos ($ATOM) had been staked, and the sweeps converted it into tokens that could be moved right away instead of waiting out the network's 21-day withdrawal period. Cryptonomist reported that one batch involved 2,265.59 staked Cosmos ($ATOM) from six Cosmos Hub accounts, and that destinations matching Web3Auth's recovery wallets accounted for about $3.5 million on Cosmos Hub and $1.04 million on Osmosis ($OSMO).

The $6 million theft figure, re-examined

Bitquery traced at least $6.01 million in transfers from more than 44,000 Keplr wallets across eight Cosmos chains since November 6, 2026, according to its investigation, reported on November 7. The firm counted 44,041 affected wallets on seven Cosmos chains plus additional addresses on Injective ($INJ). Its analysis found the theft ran for roughly 18 hours starting late on Friday, November 6, and was still active on Cosmos Hub at 15:38 UTC on Saturday, November 7, when its analysts finished counting.

The recovery list reframes that total. All eight addresses Bitquery tied to the thief are on Web3Auth's recovery list, The Block reported, which means the $6.01 million figure mixes stolen funds with funds Web3Auth moved to safety. The split between the two is not yet public, and Web3Auth has not disclosed how much it recovered, according to CryptoCoinShow.

The timing made the confusion worse. Bitquery found that 86 percent of the victim wallets were drained after Keplr issued its public warning at 04:38 UTC on November 7, 2026, when many users were still asleep or had not seen the alert. Keplr warned on November 7 that some accounts "may already show a reduced or empty balance as a result of these mitigation efforts", a line that covers both theft and rescue in the same sentence.

What Keplr users were told to do

Keplr co-founder Josh Lee wrote on X that the incident did not start in Keplr's code. "This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses," he wrote, estimating that about 20 percent of Keplr's Google and Apple login accounts were affected. He added on November 7 that only a fraction of that 20 percent appeared to have been exploited, and that the remaining accounts may be recoverable.

Keplr told Google and Apple login users to stop sending funds to those accounts and to move any remaining liquid assets to a wallet secured by a recovery phrase or a hardware device. Accounts set up with a recovery phrase or a hardware wallet were not affected, Keplr said. Web3Auth first disclosed the issue on Friday afternoon, November 6, and paused the service that lets apps create wallets through social logins. It said it found no evidence that users of MetaMask, Consensys' flagship wallet, were affected, and Trust Wallet said its users were unaffected.

Keplr said it is working with Web3Auth on a way for users to check whether their accounts were affected. No such tool was live at the time of writing, and no date has been given for restoring social login.

What is still unknown

Four questions remain open. The first is the attacker's true haul: Web3Auth has not said how many wallets the attacker hit or how much was taken, so the $6.01 million Bitquery figure cannot yet be split into stolen and rescued funds. The second is the return path: Web3Auth said it is working with Keplr on a way to return recovered funds, but no mechanism or timetable has been published. The third is the root cause: neither company has published a technical write-up of the Web3Auth flaw, so users cannot yet judge whether the same weakness touched other apps that use the service. The fourth is reimbursement: no company has said whether users whose funds were actually stolen will be made whole.

The scale of the exposure is large. Keplr said in 2025 that it had more than 2 million users, and the affected chains include Cosmos Hub, Osmosis ($OSMO), Celestia ($TIA) and Injective ($INJ), according to Bitquery and Web3Auth's recovery list. Consensys acquired Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets, which means the same login technology sits behind other wallets and apps, though Web3Auth said it found no evidence that MetaMask users were affected.

Sources

• The Block, Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets, November 8, 2026 (primary source: 12 recovery wallets hold about $5.6 million; Web3Auth used "the same path of the original attacker"; 2.49 million Cosmos ($ATOM), about $3.3 million, on Cosmos Hub; Josh Lee 20 percent estimate; all eight Bitquery attacker addresses on the recovery list; Web3Auth first disclosed Friday afternoon and paused social-login service; no evidence MetaMask users affected; Consensys acquired Web3Auth in June 2025)
• Cryptonomist, Keplr Wallet Breach: Web3Auth Recovery Efforts and Cosmos Hub ATOM, November 8, 2026 (secondary reporting: Web3Auth published verified recovery addresses; 2,265.59 staked Cosmos ($ATOM) from six Cosmos Hub accounts; $3.5 million on Cosmos Hub and $1.04 million on Osmosis matched recovery wallets; Bitquery $6.01 million transfer figure)
• Bitquery, investigation reported November 7, 2026 (secondary reporting: at least $6.01 million from more than 44,000 wallets, 44,041 affected wallets; theft ran about 18 hours from late November 6; still active on Cosmos Hub at 15:38 UTC on November 7; 86 percent of victim wallets drained after Keplr's 04:38 UTC warning)
• CryptoCoinShow, Bitquery finds $6.01M drained from 44,000 Keplr wallets via Google and Apple logins, November 8, 2026 (secondary reporting: Web3Auth has not disclosed how much it recovered; eight addresses tied to the thief on the recovery list)
• LeoDex News, Web3Auth breach exposes Keplr wallets; Bitquery estimates $6M drained, November 8, 2026 (secondary reporting: Web3Auth confirmed an infrastructure flaw; Google and Apple login accounts the main exposure; Trust Wallet and MetaMask reported no impact)

This article is news reporting and is not investment advice.