Bitquery counted at least $6.01 million moving from more than 44,000 wallets into recovery wallets — a flow the blockchain data firm first labeled theft and later reclassified as a rescue operation.
What happened to Keplr users who used Google or Apple sign‑in
Some people who created Keplr wallets using a Google or Apple account have had funds taken after an attacker exploited a security flaw in Web3Auth, the company Keplr uses to run those social logins, both companies said. Keplr described the incident as a “private key breach” for some Google‑ and Apple‑login users; Web3Auth said a security issue in its own infrastructure affected certain wallets inside the Keplr app.
The wallet maker said wallets created with a recovery phrase (12 or 24 words) or with a hardware wallet are not affected. Keplr has paused Google and Apple sign‑in while it investigates.
How Web3Auth and Keplr moved assets to safety
Web3Auth told users it used the same route the attacker exploited to access at‑risk accounts and, before the attacker could act on them, emptied those wallets into recovery wallets for safekeeping. The login provider said the moved funds are safe and that it is working with Keplr to return them to users, but it has not said how or when restorations will occur.
The provider said the rescued money was held in secure recovery wallets across 11 blockchains in the Cosmos family and eight Ethereum‑style chains. Bitquery’s chain analysis identified the transfers and later corrected its initial characterization — it cannot, the firm said, verify who controls the recovery wallets.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNumbers, timing, and what remains undisclosed
- No company has published an authoritative dollar total for stolen funds. Keplr co‑founder Josh Lee estimated early on that about 20% of Google and Apple login accounts were affected and that only a fraction of those appeared to have been exploited.
- GoPlus, a Web3 security firm, said in an alert that at least about $1 million had been stolen. The firm did not explain how it arrived at that figure.
- Bitquery counted at least $6.01 million moving from more than 44,000 wallets into the recovery wallets by late last week. Its data shows the first of those transfers occurred 21 minutes before Web3Auth’s first public notice, and that 86% of the wallets were emptied after Keplr warned users.
- Neither Web3Auth nor Keplr has disclosed technical details of the flaw, when the attacker first used it, or whether the exploited route is now closed.
What affected users should do
- Do not send new funds to the account.
- Do not re‑import the account or recreate it anywhere.
- Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
- Trust updates only from the official accounts of the wallet maker and the login provider, and ignore direct messages or links that offer “recovery.”
The wallet maker warned that staked and locked assets are taking longer to secure and said it is working with the login provider on a way for users to check whether their account was affected. The login provider published a recovery address list to help people distinguish its own transfers from possibly malicious ones and cautioned users not to assume that an unfamiliar destination address is linked to the attacker.
The provider has paused its embedded wallet service, which other apps use to build wallets, and its status page showed the login service as down at the time of the latest update.
How Keplr users, Consensys/MetaMask, and security teams are responding
Keplr users who relied on Google or Apple sign‑in are being advised to migrate liquid assets to accounts secured by a recovery phrase or hardware wallet and to avoid interacting with re‑import or recovery offers until the companies publish verified guidance.
Consensys — the company that acquired the login provider in June 2025 — said its acquisition announcement had framed the deal as enabling MetaMask users to create and recover wallets with social logins; the provider’s initial investigation found “no evidence that MetaMask users are impacted.”
Security teams and incident responders will be watching for three concrete outcomes: a transparent technical post‑mortem describing how Web3Auth’s infrastructure was breached, confirmation that the exploited route is closed, and an auditable process for returning rescued funds to rightful owners.
The rescue operation complicates the simple narrative of a theft: funds routed into recovery wallets were moved by the login provider and Keplr, not only by the attacker, and those transfers began minutes before public notice. Still unanswered are the root‑cause details, the total financial impact, and the timetable for returns — questions that will determine whether affected users recover assets or face permanent loss.
