A Keplr wallet hack hit users who created their wallets through Google or Apple logins. Web3Auth now says several addresses flagged as attacker wallets are its own recovery wallets.
The difference matters for thousands of Cosmos users. On-chain data firm Bitquery tied more than $6 million to the drain. However, part of that sum may now sit in wallets Web3Auth holds for safekeeping.
Sponsored
Sponsored
How the Keplr Wallet Hack Hit Social Login Users
Web3Auth provides login tools that let apps create crypto wallets through social accounts. On November 6, the company paused its embedded wallet service and put its login service into maintenance.
Initially, the company reported no sign of impact on MetaMask users, who faced a separate security incident in October. A day later, Web3Auth traced the flaw to its own infrastructure and confirmed that it hit some Keplr wallets.
Keplr then disabled Google and Apple sign-ins. Accounts created with a recovery phrase or a hardware wallet face no risk, the wallet team says.
Bitquery counted roughly 44,700 affected Keplr wallets across eight Cosmos-based chains. The largest single loss reached about $325,000.
The incident hit an ecosystem that already saw disruption this year. In spring, the Leap Wallet shutdown pushed many Cosmos users toward Keplr.
Sponsored
Sponsored
Rescue or Theft？ Why the Addresses Matter
Meanwhile, Web3Auth says it started a whitehat operation with its partners. The team moved funds out of vulnerable wallets before the attacker reached them, using the same access path.
Some observers mistook those transfers for part of the Keplr wallet hack. In response, Web3Auth published verified addresses on Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM chains.
Injective
inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g
dYdX
dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt
Babylon bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239
Axelar axelar1atuap9kfnt6y8ykvn3437e7j3z8qffh3y99n9a
Saga
Several of these addresses share a key with collector wallets that Bitquery had linked to the drain. Web3Auth has not said how much of the tracked total it secured.
Recovered funds are safe, Web3Auth says, and the team is working with Keplr on a way to return them. It also warned about impersonators who offer fake recovery help.
Other projects moved to calm users. PancakeSwap, for example, said its funds and smart contracts remain safe.
The Keplr wallet hack adds to a heavy year for crypto security. North Korean hackers alone took $7.61 billion in 2026. Separately, an attacker recently emptied over 1,400 Qubic wallets.