Web3Auth moves $5.6 million out of exposed Keplr wallets, racing ahead of attacker

Web3Auth, a service owned by Consensys that handles Google and Apple sign-ins for the Keplr crypto wallet, says it moved funds out of vulnerable Keplr wallets before an attacker could reach them. A flaw in Web3Auth's systems exposed the private keys — the secret codes that control a wallet — of some users who signed up with a Google or Apple account. Twelve recovery addresses published by Web3Auth held about $5.6 million in crypto as of Sunday, according to onchain data reviewed by The Block.

Key facts in short

• A flaw in Web3Auth exposed private keys of some Keplr users who logged in with Google or Apple.
• Web3Auth moved funds from wallets the attacker had not yet reached. Its 12 recovery addresses hold about $5.6 million.
• Analytics firm Bitquery reported a thief took about $6 million from more than 44,000 Keplr wallets.
• Keplr co-founder Josh Lee estimated about 20% of Google and Apple login accounts were affected.
• Users who set up Keplr with a recovery phrase or a hardware wallet are not affected.

What the companies have said

Web3Auth first disclosed the issue on Friday afternoon and paused the service that lets apps create wallets through social logins. On Saturday, it said it had started emptying vulnerable wallets the attacker had not reached, using "the same path of the original attacker." Early Sunday, it published its recovery addresses and said some of these transactions had been mistaken for attacker activity. It said the recovered funds are safe and that it is working with Keplr on a path to return them.

Keplr co-founder Josh Lee wrote on X that this was not a hack of Keplr's code and that the incident originated at Web3Auth, a provider Keplr uses. He estimated that about 20% of Keplr's Google and Apple login accounts were affected, though he said it appears only a fraction of that group has actually been exploited and the remaining accounts may be recoverable.

Web3Auth said it found no evidence that users of MetaMask, Consensys' main wallet, were affected. Consensys acquired Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets.

Recovery moves were mistaken for theft

Blockchain analytics firm Bitquery reported on Saturday that a thief collected about $6 million from more than 44,000 Keplr wallets. All eight addresses Bitquery tied to the thief appear on Web3Auth's recovery list, which suggests some of the reported theft was actually Web3Auth's own recovery activity.

Most of the recovered funds sit on Cosmos Hub, a blockchain network. Web3Auth's recovery address there holds about 2.49 million ATOM, worth roughly $3.3 million. Much of that ATOM had been staked, meaning it was locked up to help secure the network. The sweeps converted it into tokens that could be moved right away instead of waiting out the network's 21-day withdrawal period.

What remains unclear

Web3Auth's reference to an "original attacker" suggests some wallets were drained before the recovery began. The company has not said how many wallets the attacker hit or how much was taken, and it did not immediately respond to a request for further information from The Block. The Block has reached out to Web3Auth, Consensys and Keplr for comment.

What Keplr users should do

Keplr told Google and Apple login users not to send any funds to their accounts. It advised them to move any remaining funds to a wallet secured by a recovery phrase or a hardware device. Keplr warned that some accounts may already show a reduced or empty balance as a result of the mitigation efforts. The company said it is working with Web3Auth on a way for users to check whether their accounts were affected.

Sources

• The Block