Keplr Social Login Incident: Web3Auth Recovery Wallets

By Daniel GelfandPublished November 9, 202617 min read

Quick answer. Web3Auth published verified recovery addresses on November 8 for assets moved from exposed Keplr Google- and Apple-login wallets. Treat those wallets as potentially compromised, send no new funds, move liquid assets to a recovery-phrase or hardware account, and verify addresses officially.

Watch: Keplr Social Login Incident: Web3Auth Recovery Wallets 1:40

Video transcript

Keplr wallets created with Google or Apple login should be treated as potentially compromised. On November eighth, Web3Auth published verified recovery addresses for exposed wallets.

Web3Auth says its whitehat recovery used the same path as the original attacker. So a lower balance can mean theft, a recovery transfer, or both.

Bitquery measured at least six point zero one million dollars in Web3Auth's listed recovery wallets. KuCoin Flash reported about five point six million on a different basis. Neither is a theft total, so do not combine them.

Still undisclosed: how the keys were exposed, and how much the original attacker took. Web3Auth says parts of the recovery are complex and may take time. No return process or timetable has been announced.

Send no new funds, and do not reimport the account. Move liquid assets to a recovery phrase or hardware account. Check lower balances against the official recovery list, and ignore recovery offers in direct messages.

Guardian analysis: pausing social login does not revoke a key that already leaked. Containment means moving assets under a genuinely new key.

Guardian's view: wallet reviews should include the authentication provider, the key reconstruction and recovery path, cloud controls and SDK releases. This does not identify the vulnerability or promise prevention.

Read the full article for the timeline and caveats, or talk to Guardian about pentesting the login and recovery flows behind your wallet.

What Happened

On November 8, 2026, at 06:23 UTC, Web3Auth published verified recovery addresses for Keplr wallets exposed in a security incident. Web3Auth, ABAB News

Web3Auth says it and Keplr are moving assets from affected social-login wallets into those recovery wallets. Web3Auth, ABAB News

The update followed confusion onchain, where some recovery transfers had been mistaken for attacker activity. Web3Auth, ABAB News

The incident touches some Keplr accounts created with Google or Apple login. Keplr's documentation says Google-login accounts are created through Web3Auth. pwn.watch, Keplr

Keplr reported unauthorized transactions on some of those accounts and paused the Google and Apple login routes. Bitquery, pwn.watch

In its initial assessment, Keplr said recovery-phrase and hardware-wallet accounts were not affected. Bitquery, pwn.watch

Timeline

Web3Auth's status page, which is set to UTC, displays a Login Service maintenance window starting November 6 at 18:30 UTC. Web3Auth Status

The page's only dated update, posted November 7 at 05:53 UTC, gives a security incident as the reason for maintenance. Web3Auth Status

Bitquery recorded the first sweep on November 6 at 20:52 UTC, across 10 Cosmos Hub wallets, each under two cents. Bitquery said it looked like a test. Bitquery

Web3Auth paused its embedded wallet service and posted its first notice at 21:13 UTC on November 6, Bitquery says. Bitquery, pwn.watch

Keplr first warned of transactions its Google- and Apple-login users did not make on November 7 at 04:38 UTC. Bitquery

Later on November 7, MetaMask's Builder Hub restated that the Web3Auth Embedded Wallet service was temporarily paused. MetaMask Builder Hub

MetaMask said its initial investigation found no evidence that MetaMask users were impacted. MetaMask Builder Hub

Bitquery published an onchain investigation on November 7 and corrected it on November 8. Bitquery

Web3Auth's recovery-address list followed on November 8. ABAB News reported it at 08:18 UTC and linked the original post. Web3Auth, ABAB News

Why Social Login Matters Here

Keplr's documentation says Google-login accounts provide private-key export. Recovery-phrase accounts are created through a separate flow. Keplr

That split matches the line Keplr drew between affected and unaffected accounts. pwn.watch, Keplr

A social-login wallet still sits on an ordinary blockchain key. Whoever holds that key can sign for every asset at the address. Keplr, Guardian

Recovery and Theft Overlap

Web3Auth's statements refer to an original attacker. KuCoin Flash read this as suggesting some wallets were compromised before recovery began. KuCoin Flash, pwn.watch

Web3Auth said its whitehat recovery targeted vulnerable wallets not yet impacted, using the same path as the original attacker. pwn.watch

A lower balance can therefore reflect theft, a recovery transfer or both. Keplr warned that mitigation transfers could leave balances reduced or empty. KuCoin Flash, pwn.watch

Bitquery's own first version described the sweeps as theft. It corrected this after Web3Auth identified them as whitehat recovery. Bitquery

The Recovery Addresses

The update lists recovery destinations for Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric. Bitquery, ABAB News

It also lists one EVM address covering eight chains. Web3Auth said the list would be expanded. Bitquery, ABAB News

The update warned about impersonation scams and stated that the recovery addresses are not attacker-controlled wallets. ABAB News

Staked ATOM

Staked ATOM normally needs a 21-day unbonding period before it can move as ordinary ATOM. Bitquery

Bitquery found about 1.96 million staked ATOM moved to recovery wallets as transferable staking-share tokens. Bitquery

Moving the shares did not complete unbonding. Bitquery says they convert back to ATOM only after that wait, or through liquid staking services. Bitquery

About 0.18 million ATOM of staking rewards, worth about $251,000, moved with them, Bitquery says. Bitquery

Keplr said staked and locked assets add complexity and take longer to secure. pwn.watch

The Numbers and Their Limits

KuCoin Flash, relaying Odaily and onchain data, put balances across the 12 disclosed recovery addresses at about $5.6 million, including roughly 2.49 million ATOM. KuCoin Flash

Bitquery measured at least $6.01 million in addresses Web3Auth lists as recovery wallets, from transfers up to 15:38 UTC on November 7. Bitquery

It valued them at spot prices from 15:27 UTC that day. Transfers after sweeps restarted on Osmosis late on November 7 and on Noble on November 8 are not included. Bitquery

The two dollar figures use different address sets, times and valuation bases. Neither is a theft total, and they should not be combined. KuCoin Flash, Bitquery

Bitquery counted 44,041 private keys that sent funds to recovery addresses on seven Cosmos chains, each counted once however many chains it used. Bitquery

Injective uses a different address format, so Bitquery estimated its extra wallets from a sample: about 690, for a total near 44,700. Bitquery

Keplr co-founder Josh Lee estimated that about 20% of Google- and Apple-login accounts were affected, KuCoin Flash relayed. KuCoin Flash

He said only a small fraction of those appeared exploited. The estimate does not cover all Keplr users. KuCoin Flash

What Is Still Unknown

No reviewed disclosure explains how the private keys were exposed. Bitquery, ABAB News, pwn.watch

The exposure window and the total number of affected accounts are also undisclosed. Bitquery, ABAB News, pwn.watch

Neither company has named an original attacker address or said how much that attacker took. Bitquery, ABAB News, pwn.watch

Web3Auth says the recovery wallets safeguard affected assets, and that parts of the recovery are complex and may take time. Bitquery, ABAB News

No process or timetable for returning assets to users has been announced, and no technical remediation report has been published. Bitquery, ABAB News, pwn.watch

What Affected Users Should Do

If your Keplr wallet was created with Google or Apple login, treat it as potentially compromised. pwn.watch

Send no new funds to it. Keplr also said not to reimport or recreate the account anywhere. pwn.watch

Move remaining liquid assets to a Keplr account created with a recovery phrase, or to a hardware wallet. pwn.watch

If your balance looks lower, compare the receiving address with the official recovery list before drawing conclusions. ABAB News, pwn.watch

Verify recovery addresses only through official Web3Auth and Keplr channels. Ignore direct messages or links offering recovery. ABAB News, pwn.watch

Record the hash and UTC time of every transfer that left your wallet. Our wallet-drain checklist covers evidence and reporting. Guardian

Never share a recovery phrase or private key with anyone offering help. pwn.watch, Guardian

Guardian Analysis

Guardian analysis: incident records should label each outgoing transfer as suspected theft, vendor-identified recovery or completed restitution. Bitquery, ABAB News

A label should change only on new evidence, such as a match to an official address or a confirmed repayment. Bitquery, ABAB News

Guardian analysis: pausing social login closes a login route. It does not revoke a key that has already leaked. pwn.watch, Keplr, Guardian

That is why reimporting the same social-login wallet elsewhere is not containment: it restores the same exposed key. pwn.watch, Keplr, Guardian

Revoking token approvals does not solve key compromise either. Containment means moving assets under a genuinely new key. pwn.watch, Keplr, Guardian

What Wallet Teams Should Test

Guardian analysis: a wallet review that stops at the interface or the smart contracts misses the provider boundary this incident sits on. MetaMask Builder Hub, Keplr, Guardian

For embedded and social-login wallets, scope should include the authentication provider, the recovery and key-reconstruction path, APIs, cloud controls and SDK releases. MetaMask Builder Hub, Keplr, Guardian

None of this identifies the actual vulnerability or claims testing would have prevented it. Nothing here describes Web3Auth or Keplr systems beyond their public statements. Bitquery, ABAB News, Guardian

Frequently Asked Questions

Has the Web3Auth Login Service been restored?

Not according to its status page. Web3Auth said it would post an update once the service is restored, and no such update has appeared. The displayed window ended November 7 at 18:30 UTC, but that end time is not a restoration notice. Web3Auth Status

Who controls the Keplr recovery wallets?

Web3Auth and Keplr say the addresses are their recovery wallets. Bitquery states it did not check who holds the keys, and a blockchain cannot show it, so ownership rests on the companies' own statements. Bitquery, ABAB News

Can I check whether my Keplr account is affected?

Not yet through an official tool. Keplr says it is working with Web3Auth on a way to check whether an account is affected. Until that exists, its guidance applies to every Google- or Apple-login account. pwn.watch

Sources

Test the login and recovery path behind your wallet

Guardian's penetration testing covers web apps, APIs, cloud infrastructure, browser extensions, SDKs and offchain automation. Scope the authentication, key-reconstruction and recovery flows that can move user funds.

Talk to Guardian Explore the service