Keplr Outflows Include Recovery Transfers, Web3Auth Says
Keplr and Web3Auth say recovery transfers explain some apparent wallet drains. Official addresses overlap with a $6 million estimate, while final losses remain unconfirmed.
Key Notes
- Keplr says the incident affects some Google- and Apple-login wallets, while recovery-phrase and hardware-wallet accounts are unaffected.
- Eight collecting addresses in a $6 million estimate match addresses the companies identify as recovery wallets.
- Protective transfers must be distinguished from genuine theft, and the official updates do not give a final loss total.
Keplr and Web3Auth say some transfers out of compromised Keplr wallets were protective recovery operations, not additional thefts. The clarification changes how multimillion-dollar outflow estimates should be read after a security incident involving wallets created through Google or Apple login.
Web3Auth said it was moving assets into secure recovery wallets with Keplr’s assistance. Keplr separately published the addresses it said Web3Auth had verified, identifying them as recovery destinations rather than attacker-controlled wallets.
Recovery Transfers Can Resemble an Attack
In its November 8 recovery update, Web3Auth said some transactions had been mistaken for attacker activity. Its published list includes addresses on Cosmos Hub, Osmosis, Celestia, and Injective, alongside other networks and an EVM address.
The company had explained on November 7 that its whitehat recovery operation targeted vulnerable wallets that had not yet been exploited, using the same path as the original attacker. That can make protective transfers look like further wallet draining when viewed without the recovery addresses.
Keplr warned that some social-login accounts could show reduced or empty balances because of those mitigation efforts. It also said staked and locked assets make recovery more complicated and take longer to secure.
Why $6 Million Is Not a Confirmed Loss
A November 7 Bitquery investigation estimated about $6.01 million held at collecting addresses across eight Cosmos networks, describing the movements as theft.
CoinScreamer compared those eight destination addresses with Keplr’s November 8 official address list. All eight match entries the companies identify as recovery wallets, including the Cosmos Hub and Injective collectors central to Bitquery’s estimate.
That comparison does not independently establish who controls the addresses or how much will ultimately be returned. It does show why the total value moved into those destinations cannot simply be treated as a confirmed attacker loss.
The official updates reviewed do not provide a final stolen-funds total, a complete recovered-assets valuation or reimbursement terms. Confirming recovery activity also does not mean no users suffered genuine theft.
Which Keplr Accounts Are Affected
Keplr’s initial November 7 notice concerned unauthorized transactions involving some accounts created through Google or Apple authentication. Its later security guidance attributed private-key exposure to a vulnerability in Web3Auth’s infrastructure.
According to Keplr’s assessment, accounts created with a recovery phrase or a hardware wallet are not affected by this incident. Google and Apple login was paused while the teams investigated.
What Affected Users Should Do
Keplr told social-login users not to send new funds to potentially affected accounts and to move remaining liquid assets to a separate account secured by a recovery phrase or hardware wallet. Its initial warning also advised against re-importing or recreating the affected account elsewhere. Our guide to hardware wallets explains how signing keys and recovery material differ.
The team said it was working with Web3Auth on a way to check whether individual accounts were affected. It warned users to trust only official updates and ignore unsolicited messages or links offering recovery.
The published recovery addresses are a reference for identifying the companies’ protective transfers. Neither update asks users to send funds to those addresses to reclaim their assets.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
