The clarification complicates earlier estimates of the incident’s financial impact. Blockchain analytics firm Bitquery had attributed approximately $6.01 million to an attacker who drained more than 44,000 Keplr wallets. However, eight addresses previously associated with the suspected attacker appeared on Web3Auth’s subsequently published recovery list.
Why Did Web3Auth Publish Its Recovery Addresses?
Web3Auth said it began moving assets from vulnerable wallets that had not yet been reached by the attacker, using the same access mechanism involved in the original incident. The operation was intended to secure remaining funds before they could be transferred by whoever had obtained access to the exposed private keys.
Because the recovery operation used the same transaction path, some transfers initially appeared indistinguishable from unauthorized withdrawals. Web3Auth subsequently published addresses covering Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, alongside an EVM address covering eight additional chains.
Keplr independently relayed the list, describing the destinations as recovery addresses rather than malicious wallets. Web3Auth said it would publish additional addresses as they were verified.
The distinction is important because blockchain transactions do not independently establish who controls a receiving address or whether a transfer represents theft or protective intervention. The companies’ identification of the destinations provides new context, but a complete reconciliation of attacker withdrawals and recovery transfers remains outstanding.
Investor Takeaway
The $6.01 million figure should not automatically be treated as the final amount stolen. The overlap between Bitquery’s suspected attacker addresses and Web3Auth’s recovery list means investigators need to separate unauthorized withdrawals from assets subsequently secured through the recovery operation.
How Many Keplr Wallets Were Exposed?
The incident originated in Web3Auth’s infrastructure rather than Keplr’s wallet application, according to both companies. Web3Auth provides the embedded-wallet technology that allows users to create and access cryptocurrency wallets through Google and Apple authentication without managing a conventional recovery phrase.
Keplr co-founder Josh Lee estimated that approximately 20% of accounts using those social-login methods could have been affected. He subsequently said only a fraction appeared to have been exploited, while other vulnerable accounts might still be recoverable.
Bitquery’s November 7 investigation identified at least 44,041 affected addresses across seven Cosmos chains and another 7,603 on Injective. It attributed approximately $6.01 million to two receiving addresses associated with the suspected attacker.
Its investigation also identified approximately 1.96 million ATOM in staked assets that were moved without waiting through the network’s normal 21-day unbonding period. The operation used liquid-staking mechanisms to transfer claims on staked assets rather than simply waiting for conventional withdrawals.
Web3Auth’s subsequent recovery disclosure does not establish how much of the tracked cryptocurrency was actually stolen, how much was rescued before the attacker reached it or how many individual customers suffered losses.
Investor Takeaway
The incident demonstrates how a vulnerability in shared wallet infrastructure can affect multiple applications and thousands of accounts without compromising the underlying blockchain networks. The number of exposed wallets and the amount actually stolen remain separate measures of the incident’s severity.
What Happens to the Recovered Cryptocurrency?
Web3Auth said the recovered assets were safe and that it was working with Keplr on a process for returning them. Neither company has published a complete claims procedure, recovery schedule or compensation commitment.
Staked and locked assets present additional operational difficulties. Keplr has warned that some accounts may already display reduced or zero balances because of the protective transfers, while assets subject to staking restrictions can take longer to secure.
Users who created wallets through Google or Apple authentication have been advised not to deposit additional funds into potentially affected accounts and to transfer remaining liquid assets into wallets secured by a recovery phrase or hardware device. Keplr has also paused social-login functionality while the investigation continues.
The incident follows other recent infrastructure-related security concerns affecting cryptocurrency wallet providers. MetaMask recently disclosed a separate security incident affecting part of its infrastructure, although it reported no immediate threat to customer wallets.
Web3Auth also said its initial investigation found no evidence that MetaMask users were affected by the Keplr-related vulnerability. Consensys acquired Web3Auth in June 2025 and subsequently incorporated the technology into its embedded-wallet offering.
Will Web3Auth Reimburse Users for Confirmed Losses?
The recovery operation does not necessarily mean every affected customer will receive all their assets back. Some wallets were reportedly drained before the protective transfers began, and Web3Auth has acknowledged the involvement of an original attacker without disclosing the full extent of those losses.
The company has also not published a technical root-cause report explaining how its infrastructure exposed private keys, how the attacker obtained access or what security changes will prevent a recurrence.
For now, the priority is securing remaining vulnerable assets, completing the recovery transfers and establishing a reliable accounting of what was stolen versus what was rescued. Both companies have warned users about impersonators and fraudulent recovery requests, emphasizing that customers should rely exclusively on official announcements.
The next major disclosure will need to establish the total value recovered, confirmed customer losses and the mechanism through which affected users can reclaim their cryptocurrency. Until then, the $5.6 million held at the published recovery addresses represents assets reportedly secured, not proof that the entire incident has been resolved.
Investor Takeaway
The recovery operation has reduced uncertainty over some suspicious on-chain transfers, but it has not settled the financial damage. A technical postmortem, independently reconciled asset accounting and a documented customer-return process remain necessary to establish the full consequences of the breach.