Web3Auth says 12 addresses hold crypto it moved out of vulnerable Keplr wallets, and the eight that Bitquery had identified a day earlier as a thief's collection wallets are among them. The provider used the attacker's own route, so the published totals describe overlapping holdings rather than separate pools.
Web3Auth published 12 addresses early on November 8 that it says hold crypto it moved out of Keplr wallets whose private keys its own systems had exposed. All eight of the addresses that the analytics firm Bitquery had identified a day earlier as a thief's collection wallets appear on that list, according to The Block, which reviewed on-chain data showing about $5.6 million across those addresses later that day.
The incident started on November 6. Web3Auth, a Consensys-owned service that provides Google and Apple sign-in for the Keplr wallet, said at about 21:13 UTC that a security issue affected services used by some third parties and paused its embedded wallet service. Keplr posted at about 04:38 UTC the next day that it had received reports of unauthorized transactions on accounts created with Google or Apple login, and it suspended both login methods. Accounts set up with a recovery phrase or a hardware wallet were not affected.
Josh Lee, a Keplr co-founder, wrote on X that "This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses." He estimated that about 20% of Keplr's Google and Apple login accounts were affected, and said on Saturday that "It appears only a fraction of that 20% has actually been exploited, and the remaining accounts may be recoverable."
Bitquery published its own tracing on November 7. Reading eight Cosmos chains from public nodes and counting every transfer into the collection addresses up to 15:38 UTC that day, it put at least $6.01 million in those wallets: about $3.50 million on Cosmos Hub, $1.04 million on Osmosis, $615,000 on Injective and the rest across five other chains. It called the total a floor, because unpriced tokens were excluded and the values use spot prices rather than prices at the moment of each transfer. It counted 44,041 wallets on seven Cosmos chains, where one private key controls addresses on all seven, plus 7,603 on Injective and an estimated 440 to 934 more from a sample of 299 victims, for roughly 44,700 distinct wallets.
Bitquery was explicit about what it had not been able to rule out. "Neither Keplr nor Web3Auth has said it moved user funds to a safe address for them," the investigation said, adding, "We think that unlikely." Its disclaimer describes the wallets by their on-chain conduct and attributes them to nobody, says the links do not identify a person, and warns that the attributions may be incomplete or wrong and may be revised.
Web3Auth's publication the next day addressed that possibility directly. The provider said on Saturday that it had begun emptying vulnerable wallets the attacker had not yet reached, using "the same path of the original attacker," and that "Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users." Because the recovery ran down the exploit's own route, the sweeps and the theft look alike on-chain, and crypto.news reported that some of the protective transfers were at first mistaken for theft.
The two published totals therefore describe overlapping holdings rather than separate pools. Bitquery's ATOM total for the attacker was 2.49 million, and the Cosmos Hub recovery address The Block examined holds about 2.49 million ATOM, worth roughly $3.3 million. Web3Auth has still referred to an "original attacker" and has not said how many wallets were drained or how much was taken, so the chain by itself does not establish how much of the $6.01 million was a rescue and how much was a theft.
Much of that ATOM had been staked. Bitquery recorded 1.96 million ATOM moved as share tokens, 79% of the Cosmos Hub total, and The Block reported that the sweeps converted staked ATOM into tokens that could move immediately instead of waiting out the 21-day unbonding period. Bitquery valued those share tokens at their validator's exchange rate.
For an account holder, a missing balance may be gone for either reason. Keplr warned that some accounts "may already show a reduced or empty balance as a result of these mitigation efforts," told Google and Apple login users not to send funds to those accounts, and advised moving anything left to a recovery-phrase or hardware-wallet account. It also told users not to re-import or recreate affected accounts elsewhere and to ignore unsolicited recovery offers. Bitquery found that 86% of the wallets it tracked on the seven same-key chains recorded outgoing transfers after Keplr's warning, a figure that does not separate the attacker's sweeps from the provider's.
Other recent incidents have also traced back to a supplier rather than the company users deal with directly. Polymarket paused trading in October and blamed a compromised provider, and Gnosis Pay disclosed on Friday that unauthorized access to a legacy card system exposed customer data, with notifications listing fields that its public notice never named.
How the keys were exposed is still unexplained. "Neither Keplr nor Web3Auth has said how the keys were exposed, and the ledger cannot show it," Bitquery wrote. Web3Auth said an initial investigation found no evidence that users of MetaMask, Consensys' flagship wallet, were affected; Consensys acquired Web3Auth in June 2025. As of Saturday the embedded wallet service was still paused and Keplr's Google and Apple logins had not been restored, and Keplr has not said whether affected users will be reimbursed.
