Some movements out of Keplr cryptocurrency wallets that initially looked like a broad theft were part of an emergency recovery operation. Web3Auth says it used a security weakness in its own
Some movements out of Keplr cryptocurrency wallets that initially looked like a broad theft were part of an emergency recovery operation. Web3Auth says it used a security weakness in its own embedded-wallet infrastructure to move assets away from vulnerable accounts before attackers could reach them. The firms are still working to reconcile the incident and return recovered assets to users.
The distinction is unusually important. Keplr’s November 7 warnings identified a risk to some wallets created through Google or Apple login, while saying wallets created with a recovery phrase or hardware wallet were not affected by this particular Web3Auth issue. Users who saw balances disappear were not necessarily looking at a confirmed theft: certain balances had been moved into identified recovery addresses by the responding teams.
Keplr said it had received reports of unauthorized transactions on accounts created through social login. It traced the issue to Web3Auth, the service providing part of that login infrastructure, rather than an exploit of the Keplr wallet application’s underlying code. The Web3Auth team temporarily paused the affected embedded-wallet service.
An embedded wallet abstracts away many of the key-management steps that users of traditional self-custody wallets handle manually. When an infrastructure-level weakness exposes private keys, however, ease of login becomes a potential common point of failure for many accounts.
On November 8, Web3Auth published verified recovery addresses and said it was moving funds into safer wallets with Keplr’s help. This was described as a white-hat effort to protect assets in accounts believed to be at risk.
The Block reported that 12 recovery addresses identified by Web3Auth held around $5.6 million when it reviewed on-chain balances on November 8. That is a snapshot of funds attributed to the recovery wallets, not a verified total of funds stolen, lost or ultimately reimbursed. The companies have not published a final audited loss figure.
Part of the initial confusion arose because some blockchain-tracing reports classified withdrawals into those addresses as attacker activity before the firms disclosed the recovery destinations. On-chain transactions can show where tokens moved, but their purpose and authorized controller require additional corroboration.
Keplr advised Google- and Apple-login users not to send more funds to affected accounts and to move remaining liquid assets to wallets secured by a recovery phrase or hardware device. It warned users to rely on official updates and ignore direct messages or websites promising special recovery procedures. Staked or locked assets may take longer to secure.
The operational lesson resembles the one in Optimisus’s recent account of the BTCPay Server wallet-security incident: patching or freezing a service does not automatically restore trust in previously exposed wallet secrets. By contrast, the earlier Binance withdrawal-system attackconcerned exchange infrastructure rather than the social-login wallet architecture affected here.
The full number of compromised accounts, independently confirmed attacker losses, precise asset-recovery process and final reimbursement arrangements remain open questions. Those uncertainties are why a headline claiming that “$5.6 million was stolen from Keplr” would be inaccurate based on the evidence presently available.
Web3Auth official recovery statement, November 8, 2026; MetaMask developer notice, November 7, 2026; The Block’s on-chain balance review, November 8, 2026
