Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets

Judgment

Keplr's Google/Apple-login users must decide whether to keep using social-login wallets or migrate remaining funds to recovery-phrase or hardware wallets, accepting self-custody friction in exchange for removing Web3Auth as a single point of key exposure.

Basis

Web3Auth said a flaw in its service exposed private keys for Keplr wallets created with Google or Apple login; it moved funds through "the same path of the original attacker" into 12 recovery addresses holding about $5.6 million. Keplr co-founder Josh Lee said the incident originated at Web3Auth, not Keplr's code, and estimated about 20% of Keplr's Google and Apple login accounts were affected, while only a fraction of that 20% appears exploited. Bitquery reported a thief collected about $6 million from more than 44,000 Keplr wallets; The Block noted all eight addresses Bitquery tied to the thief are on Web3Auth's recovery list. Most recovered funds are on Cosmos Hub: about 2.49 million ATOM, worth roughly $3.3 million, with staked ATOM converted to movable tokens instead of waiting out the 21-day withdrawal period. Web3Auth referred to an "original attacker" but did not say how many wallets were hit or how much was taken.