Web3Auth said it had transferred funds from vulnerable Keplr wallets to prevent them from being accessed by attackers. The operation occurred after a flaw in its authentication system exposed private keys of users who created wallets with Google or Apple accounts. According to a verification published by The Block on Sunday (8), 12 recovery addresses disclosed by the company held approximately US$ 5.6 million in cryptocurrencies.
The company, which belongs to Consensys, said it used the same access path exploited by the attacker to withdraw assets from wallets not yet compromised. The measure was described as a preventive recovery operation, carried out in collaboration with Keplr, while the companies work to return the funds to the respective users.
The vulnerability was identified in Web3Auth's infrastructure, responsible for the social login mechanism used by Keplr. Josh Lee, co-founder of the wallet, clarified in a post on X: “It was not a breach of Keplr's code.” According to him, approximately 20% of Keplr accounts created through Google or Apple authentication were potentially exposed, although only a portion of them appears to have been exploited by attackers.
Recovery addresses were initially confused with criminal wallets
The distinction between protective transfers and possible thefts changed the initial interpretation of the incident.
On November 7, blockchain analysis firm Bitquery published an investigation that identified approximately US$ 6 million moved from more than 44,000 Keplr wallets. Initially, the funds were classified as amounts withdrawn by an attacker.
However, the eight addresses associated with the suspicious transactions also appeared on the recovery list later disclosed by Web3Auth. On November 8, Bitquery corrected its investigation, acknowledging that it had interpreted the rescue transfers as thefts.
The original analysis recorded about US$ 6.01 million in the addresses monitored on November 7. The Block's survey, meanwhile, found approximately US$ 5.6 million in the 12 recovery addresses on November 8. The amounts represent distinct surveys, not confirmed estimates of loss.
Bitquery also identified the movement of approximately 1.96 million ATOM tokens that were in staking, a mechanism through which cryptocurrencies are tied to a network's security. The operations converted positions into transferable tokens, allowing the assets to be moved without waiting for the Cosmos Hub network's standard 21-day unlocking period.
Although Web3Auth mentioned an original attacker, none of the companies publicly established the amount actually stolen before the containment. Nor were the addresses attributed to that attacker disclosed. Therefore, the transfers identified in the recovery addresses cannot automatically be counted as user losses.
Keplr said that wallets created with recovery phrases or physical key storage devices were not affected by the identified vulnerability. For users who used Google or Apple authentication, the guidance is not to deposit new funds into potentially compromised accounts and to transfer the remaining liquid assets to wallets protected by recovery phrases or physical devices.
The companies also warned about possible fraud attempts involving fake recovery offers. Web3Auth says the protected assets remain safe, but it has not yet set a public deadline for their return.
