Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets

Web3Auth, the Consensys-owned service that runs Google and Apple sign-in for crypto wallet Keplr, said it moved funds out of vulnerable Keplr wallets to keep them away from an attacker. The 12 addresses it says hold the recovered funds had about $5.6 million in crypto as of publicatino time on Sunday, according to onchain data reviewed by The Block.

A flaw in Web3Auth's systems exposed the private keys of some Keplr Wallet users who signed up with a Google or Apple account, the firms said. Though it was initially designed for the Cosmos ecosystem, Keplr now supports now supports many non-Cosmos chains, including EVM networks, and said in 2025 that it had more than 2 million users. 

"This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses," Keplr co-founder Josh Lee wrote on X, estimating that about 20% of Keplr's Google and Apple login accounts were affected. Users who set up Keplr with a recovery phrase or a hardware wallet are not affected, Keplr said.

Recovery initially mistaken for theft

Web3Auth said on Saturday it had started emptying vulnerable wallets the attacker hadn't reached yet, using "the same path of the original attacker." "Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users," Web3Auth said.

Web3Auth's reference to an "original attacker" suggests some wallets were drained before the recovery began. Web3Auth has not said how many wallets the attacker hit or how much was taken, and did not immediately respond to a request for further information from The Block. 

"We are aware that some of these transactions have been mistaken for attacker activity," Web3Auth said early Sunday, when it published its recovery addresses. Blockchain analytics firm Bitquery had reported on Saturday that a thief collected about $6 million from more than 44,000 Keplr wallets. All eight addresses Bitquery tied to the thief are on Web3Auth's recovery list.

Most of the recovered funds are on Cosmos Hub, where Web3Auth's recovery address holds about 2.49 million ATOM Cosmos Hub (ATOM), worth roughly $3.3 million. Much of that ATOM had been staked, and the sweeps converted it into tokens that could be moved right away instead of waiting out the network's 21-day withdrawal period. 

Users advised to move remaining funds

Lee said on Saturday that many vulnerable accounts may have dodged the attack. "It appears only a fraction of that 20% has actually been exploited, and the remaining accounts may be recoverable," he wrote. Keplr warned that some accounts "may already show a reduced or empty balance as a result of these mitigation efforts."

Keplr told Google and Apple login users not to send any funds to their accounts, advising them to move any remaining funds to a wallet secured by a recovery phrase or a hardware device. Keplr said it is working with Web3Auth on a way for users to check whether their accounts were affected.

Web3Auth first disclosed the issue on Friday afternoon and paused the service that lets apps create wallets through social logins. It said it had found no evidence that users of MetaMask, Consensys' flagship wallet, were affected. Consensys acquired Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets, according to its developer documentation.

The Block has reached out to Web3Auth, Consensys and Keplr for comment.