Web3Auth Flaw and the Keplr Wallet Rescue: $6M Moved Before the Attacker Could

Some people who created a Keplr crypto wallet with Google or Apple login had money stolen. Keplr runs that sign-in through Web3Auth; a flaw in the login provider's own infrastructure let the attacker reach the wallets.

The remarkable part of the story: Web3Auth used the attacker's own route to empty at-risk wallets before the attacker reached them, moving funds — with the wallet maker's help — into recovery wallets. An empty balance may mean the money was rescued, not stolen. Wallets made with a recovery phrase or hardware wallet are unaffected.

The Numbers

• Keplr co-founder Josh Lee's early estimate: about 20% of Google/Apple login accounts were affected, only a fraction exploited so far.
• GoPlus estimated at least ~$1 million stolen (method undisclosed).
• Bitquery counted at least $6.01 million moving out of 44,000+ wallets into recovery wallets — initially reported as theft, then corrected by Bitquery itself as the rescue. It cannot verify who controls the recovery wallets.
• The first rescue transfer preceded Web3Auth's first public notice by 21 minutes. 86% of emptied wallets were drained after Keplr's warning.

The login provider says the funds are safe and it works with Keplr to return them — it has not said how or when.

What Led to the Breach

In its incident update, Web3Auth said a security issue in its own infrastructure affected certain wallets it provides inside the Keplr app. Keplr went further: a "private key breach" for some Google/Apple sign-in users. Neither company has said how the flaw worked, when the attacker first used it, or whether that route is closed.

The login provider paused its embedded wallet service and shows its login service as down on its status page. Consensys — MetaMask's maker, which bought Web3Auth in June 2025 — says its initial investigation found "no evidence that MetaMask users are impacted."

What Affected Users Should Do

Keplr's guidance for Google/Apple-login accounts:

• Do not send new funds to the account.
• Do not re-import or recreate the account anywhere.
• Move unstaked/unlocked funds to an account using a recovery phrase or hardware wallet.
• Trust updates only from the official accounts of the wallet maker and the login provider — ignore DMs offering "recovery."

Staked and locked assets are taking longer to secure. The rescued funds sit in recovery wallets across 11 Cosmos-family chains and 8 Ethereum-style chains. Web3Auth published a recovery address list so users can distinguish rescue transfers from malicious ones; it also warns that an unfamiliar destination is not necessarily attacker-linked.

The deeper lesson: when a social-login layer controls private keys, an infrastructure flaw becomes a wallet-draining machine — and the rescue by the same channel is both the mitigation and the proof it worked.

Sources

• The Hacker News coverage
• Bitquery corrected analysis
• Keplr user guidance
• Web3Auth incident update
• Web3Auth status page