Web3Auth disputes $6.01 million Keplr wallet theft report
Web3Auth rejected reports that $6.01 million was stolen from Keplr wallets, explaining that flagged transfers were actually funds moved to verified recovery addresses to safeguard user assets.
Web3Auth has disputed widely circulated reports estimating a $6.01 million theft from Keplr wallets, according to posts by Coin Bureau and reporting by The Block. Blockchain analytics firm Bitquery had initially flagged several transactions as suspected theft after a Web3Auth vulnerability exposed private keys for some Keplr wallets. However, Web3Auth stated that the transfers in question were mistaken for hacker activity and were actually directed to verified recovery wallets with Keplr's assistance to protect user assets.[1][2][3][4]
According to The Block, Web3Auth disclosed that it rescued $5.6 million from Keplr wallets compromised by a flaw in its Google and Apple login integration before attackers could drain them. While Web3Auth acknowledged that an original attacker managed to hit some wallets first, it has not revealed how much was stolen, leaving the confirmed loss total unknown.[2][3]
The incident prompted Keplr to pause its Google and Apple login services following reports of unauthorized transactions. Keplr warned that some wallets created through those social logins might be affected, but assured users that wallets generated via standard recovery phrases or hardware devices remain completely safe. Web3Auth also cautioned users to ignore unsolicited direct messages claiming to offer fund recovery services and published verified recovery wallet addresses spanning Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM chains.[2][4]
Key facts
- Web3Auth disputed a circulating $6.01 million theft estimate involving Keplr wallets, stating flagged addresses are verified recovery wallets.
- Bitquery originally flagged the transactions as suspected theft after a Web3Auth breach exposed private keys for certain Keplr wallets.
- Web3Auth said it moved $5.6 million out of flaw-exposed wallets to recovery addresses with Keplr's help before hackers could access the funds.
- Web3Auth acknowledged an original attacker hit some wallets first, but the total amount stolen remains unconfirmed.
- Keplr paused Google and Apple logins, stating wallets using those logins may be affected while recovery-phrase and hardware wallets are unaffected.
- Web3Auth warned users against direct messages offering fund recovery and shared public recovery addresses across Cosmos Hub, EVM, and other networks.
Sources · 3 sources
- CB
Crypto BriefingArticle ·
Web3Auth disputes $6.01 million Keplr theft estimate, says funds went to recovery wallets The incident highlights the vulnerability of social-login wallets and the challenges in accurately assessing crypto security breaches in real-time. The post Web3Auth disputes $6.01 million Keplr theft estimate, says funds went to recovery wallets appeared first on Crypto Briefing .
Open source - CB
Coin Bureau@coinbureauPost on X ·
⚠️UPDATE: Web3Auth debunks the circulating $6.01 MILLION Keplr theft reports, saying the addresses Bitquery traced are VERIFIED recovery wallets. Bitquery initially flagged the transfers as suspected theft after a Web3Auth breach exposed private keys for some Keplr wallets. Web3Auth says it moved the funds with Keplr’s help to PROTECT users’ assets. The confirmed loss total remains UNKNOWN. Keplr recently PAUSED Google and Apple logins after reports of unauthorized transactions. Keplr warned some wallets created with either login may be AFFECTED. Yet, Keplr assured wallets created with a recovery phrase or hardware wallet were UNAFFECTED. Web3Auth warned users to ignore DMs offering to recover funds and published these verified recovery addresses.
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Web3Auth says it moved $5.6 million out of Keplr wallets exposed by a flaw in its Google and Apple login service before hackers could take it. It also referred to an “original attacker” who hit some wallets first, but hasn’t said how much was stolen. https://t.co/LLZYf05vnr
Open source - CB
Coin Bureau@coinbureauPost on X ·
⚠️UPDATE: Web3Auth DEBUNKS the circulating $6.01 MILLION Keplr wallet theft estimate, saying the addresses behind it are VERIFIED recovery wallets. Web3Auth says it moved funds to those wallets with Keplr’s help to protect users’ assets. Those transfers were MISTAKEN for attacker activity. Keplr recently paused Google and Apple logins after reports of unauthorized transactions. Some wallets created with those logins were considered AFFECTED. But Keplr assured wallets created with a recovery phrase or hardware wallet were UNAFFECTED. Web3Auth warned users to ignore DMs offering to recover funds and published these verified recovery addresses: Cosmos Hub cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu Osmosis osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw Celestia celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53 Akash akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx Noble noble1atuap9kfnt6y8ykvn3437e7j3z8qffh3ggxnkj Injective inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g dYdX dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt Babylon bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239 Axelar axelar1atuap9kfnt6y8ykvn3437e7j3z8qffh3y99n9a Saga saga1atuap9kfnt6y8ykvn3437e7j3z8qffh37c2ff6 Agoric agoric1atuap9kfnt6y8ykvn3437e7j3z8qffh3jk3y72 EVM (8 chains) 0x413e4F4De7E5FF010913488F781E679e76f706dA
Open source