A race to secure exposed funds
Web3Auth said in an update that it was transferring assets from vulnerable Keplr wallets into secure recovery wallets. The company published verified recovery addresses and warned users that some blockchain observers had mistakenly interpreted the defensive transactions as additional theft.
The incident affects Keplr accounts created through Google or Apple authentication. Keplr said in its warning that users with unauthorized transactions should not deposit more funds into affected wallets or re-import them. Accounts created with recovery phrases and wallets secured by hardware devices were not affected, according to the company.
The vulnerability originated in Web3Auth’s social-login infrastructure rather than in Keplr’s core wallet software. That distinction matters because it highlights the security risks created when crypto wallets rely on outside providers for key generation, authentication and account recovery. Social login can reduce the technical barriers to entering digital assets, but it can also introduce a centralized point of failure into systems designed to give users direct control of their funds.
The Block reported that Web3Auth moved approximately $5.6 million into 12 recovery addresses. The recovered assets included about 2.49 million ATOM, worth roughly $3.3 million at publication. Much of that ATOM had been staked, so the recovery process converted it into assets that could be transferred immediately rather than waiting through Cosmos Hub’s 21-day unstaking period.
Web3Auth said it used the same transaction path as the attacker to move assets from wallets that had not yet been reached. That approach allowed the company to act quickly, but it also made the transfers difficult to distinguish from an ordinary theft when viewed only through blockchain data.
Disputed interpretation of the transactions
Bitquery’s on-chain investigation attributed at least $6.01 million in transfers from more than 44,000 wallets to attacker-controlled collector addresses. Bitquery also questioned whether the later recovery addresses were actually controlled by Web3Auth, adding to uncertainty around the transactions.
The supplied sources contain no independent confirmation resolving that dispute. Web3Auth has publicly identified recovery addresses and described the transfers as a protective measure, while Bitquery has maintained a critical interpretation of the on-chain movements. The conflicting readings show the difficulty of establishing ownership during a live crypto incident, particularly when an intervention uses automated or attacker-like transaction patterns.
Keplr co-founder Josh Lee estimated that roughly 20% of Google- and Apple-login accounts could have been affected, according to The Block. The estimate describes potential exposure, not confirmed losses. Only a fraction of the potentially vulnerable accounts appeared to have been exploited, and Web3Auth has not disclosed how many wallets the original attacker drained or the total amount stolen.
Recovery raises broader custody questions
Web3Auth and Keplr are working on returning recovered assets, but users with remaining balances have been advised not to send additional funds to affected accounts. They should instead migrate assets to wallets protected by a recovery phrase or hardware device, according to Keplr’s warning.
The episode illustrates a policy question that extends beyond one wallet provider. As crypto companies seek easier onboarding, social authentication is increasingly positioned as a bridge for users who may find seed phrases and hardware wallets intimidating. Yet the same design can shift part of the security burden from the user to an authentication provider, whose systems may operate across jurisdictions and outside the wallet’s own codebase.
For consumers, the immediate lesson is operational: convenience does not necessarily mean isolation from third-party failures. For wallet developers and institutional participants, the incident raises a deeper infrastructure question about whether social recovery systems can provide consumer-friendly access without recreating the centralized dependencies that crypto was intended to reduce.
Sarah Thompson is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Sarah Thompson's usual length and in Sarah Thompson's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 11/9/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.