Web3Auth says it moved roughly $5.6 million from vulnerable Keplr wallets into recovery addresses by November 8, before attackers could reach the funds. The operation followed a security issue Web3Auth disclosed on November 6. Keplr said the exposure affected some wallets created through Google or Apple sign-in, which relied on Web3Auth’s embedded-wallet system. Wallets protected by a recovery phrase or hardware device weren’t in scope.
One published Cosmos Hub recovery address held about 2,492,000 Atom, valued near $3.3 million. That’s the largest disclosed recovery wallet. By November 8, funds had been moved across multiple Cosmos ecosystem chains. The companies said some transfers were mistaken for attacker activity. Roughly 44,700 wallets were flagged as potentially affected, but that doesn’t mean every transfer was theft.
The published recovery addresses are now a key check on where assets went. Keplr warned that affected balances may temporarily appear reduced or empty, particularly where assets are staked or locked. Web3Auth and Keplr say they’re working to return funds, but haven’t given a final timetable or published a full postmortem.
Until there’s confirmation for each destination, the public address list and chain data provide an audit trail, not proof that every affected user’s assets have been recovered. The incident also puts the third-party sign-in layer in view: a wallet’s security can depend on the infrastructure underneath its familiar interface.