keplr web3auth exploit: $5.6M Moved From Exposed Social-Login Wallets

The keplr web3auth exploit turned a quiet Friday into a weekend scramble for anyone who signed up for the Cosmos wallet with a Google or Apple login. Web3Auth, the sign-in provider behind those accounts, said a flaw in its infrastructure exposed private keys for some Keplr users. By Sunday, The Block reported that Web3Auth's 12 published recovery addresses held about $5.6 million, which the firm said it moved out of vulnerable wallets to keep them away from an attacker.

What actually happened

Web3Auth first disclosed a security issue on Friday afternoon and paused the service that lets apps create wallets through social logins. An advisory indexed by 0xCert says Keplr then paused Google and Apple login and told users not to send new funds to affected accounts. A write-up on DEV Community put Web3Auth's first notice at 21:13 UTC on November 6 and Keplr's first public warning at 04:38 UTC on November 7.

The Block reports that Web3Auth is owned by Consensys and now marketed as MetaMask Embedded Wallets, and that Web3Auth saw no evidence MetaMask users were affected. That is a preliminary statement, not a completed forensic report. Keplr said in 2025 that it had more than two million users, though no one has published how many used social login.

The recovery that looked like theft

Here is the confusing part. Web3Auth said on Saturday it began emptying vulnerable wallets the attacker had not reached yet, using "the same path of the original attacker." It later admitted some of those transactions were mistaken for attacker activity. Bitquery reported on Saturday that a thief had collected about $6 million from more than 44,000 Keplr wallets, but The Block noted that all eight addresses Bitquery tied to the thief appear on Web3Auth's recovery list.

In other words, on-chain trackers were looking at one pile of moves and reading it two ways. Web3Auth's mention of an "original attacker" suggests some wallets were drained before the sweep began, but the firm has not said how many or how much. The Block says most recovered funds sit on Cosmos Hub, where one recovery address holds about 2.49 million ATOM worth around $3.3 million. Much of that ATOM had been staked, and the sweep converted it into movable tokens instead of waiting out the 21-day unbonding period.

What nobody has published yet

As of the sources we read, neither company has released a root cause, an official loss total or a list of attacker addresses. The 0xCert advisory says the same and cautions that loss figures circulating in the press are unverified. GoPlus separately posted that at least roughly $1 million was stolen and about $6 million was moved to rescue addresses, which fits a mixed theft-and-recovery picture but is still a third party's reading.

Keplr also warned that some accounts "may already show a reduced or empty balance as a result of these mitigation efforts." If you log in and see zero, that does not automatically mean a thief got there. It may mean funds were swept to a recovery wallet, and Keplr and Web3Auth say they are working on a way to return them and to let users check their status.

The bigger lesson on social-login wallets

The keplr web3auth exploit is a clean case study in that trade-off. Social login is popular because it removes seed phrases. The trade-off is custody you do not see: a service somewhere holds or helps reconstruct the key. When that service breaks, every wallet built on it breaks together. We have followed other security incidents in the same news cycle, including the gnosis pay breach and the polymarket debugbear drain, and the habit that helps in all of them is the same: know who holds the keys.

None of that means every embedded wallet is unsafe. It means the question to ask is who can sign for you if their servers are compromised.

What to do as a reader

If you used Keplr with a Google or Apple login, follow Keplr's official guidance only. Do not send new funds to that account, do not re-import or recreate it based on a DM, and treat any "recovery" message from a stranger as phishing. Move what remains to a wallet you control with a recovery phrase or hardware device, once Keplr confirms the safe process.

Read Keplr's and Web3Auth's posts on X, check The Block's report for updates, and treat the keplr web3auth exploit as a prompt to review which of your wallets depend on a third party. Nothing here is investment advice.