The short version
- Keplr wallet accounts made with Google or Apple login had their private keys exposed by a flaw at Web3Auth, which paused its service at 21:13 UTC on November 6.
- Keplr co-founder Josh Lee estimates about 20% of those accounts were affected and only a fraction exploited; seed-phrase and hardware-wallet accounts are safe.
- Web3Auth swept exposed wallets into 12 recovery addresses, so an empty balance may be a rescue; the Cosmos Hub address alone holds about 2.5 million ATOM.
- Next: a checker for affected accounts and a way to get secured funds back, both promised but not dated yet.
Keplr wallet accounts opened with a Google or Apple login are no longer safe to use. A flaw at Web3Auth, the Consensys-owned login service behind those accounts, exposed their private keys, and some were drained before anyone could step in.
Web3Auth paused its embedded wallet service at 21:13 UTC on Friday, November 6. By early Saturday, Keplr had paused Google and Apple login too. Since then, Web3Auth has been moving funds out of exposed wallets before an attacker can, and it has published 12 recovery addresses. The Cosmos Hub one alone holds about 2.5 million ATOM.
So is your wallet one of them, and what should you do with it? Keplr spelled it out on Saturday:
What this means for Keplr users
If you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected.
In response to Web3Auth’s infrastructure vulnerability leading to private key breach some Keplr users who signed in with Google or Apple, we are
Is My Keplr Wallet Affected?
Only if you created it with Google or Apple login. Keplr says wallets made with a seed phrase or a hardware wallet are not affected.
Not every social-login account was hit, either. Keplr co-founder Josh Lee put the early estimate at about 20% of Google and Apple accounts, and said “only a fraction of that 20% has actually been exploited.” He was also clear about where the fault sits: “This was not a hack of Keplr’s code.”
There is no checker yet. Keplr says it is working with Web3Auth on a way to see whether an account was affected. Until then, treat every Google or Apple login account as exposed.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
What Keplr Wallet Users Should Do Now
Keplr’s instructions are short. Follow them in this order:
- Stop depositing. Don’t send new funds to a Google or Apple login account.
- Move what you can. Send liquid tokens to a new account made with a recovery phrase or a hardware wallet.
- Don’t re-import it. Don’t recreate that account in Keplr or any other wallet app.
- Ignore “recovery” offers. Trust only @keplrwallet and @Web3Auth. Anyone in your DMs offering to recover funds is a scammer.
Staked tokens are harder. Keplr says staked and locked assets “add complexity and take longer” to recover, and unstaking ATOM on Cosmos Hub takes 21 days anyway. Wait for the official steps on those.
Write the new recovery phrase on paper and keep it offline. That one habit is the whole difference between the accounts Keplr calls safe and the ones it doesn’t.
SIDE TRAIL: Your First Crypto Wallet, Set Up Safely: Hot vs Cold and the Seed Phrase
Why Your Balance May Show Zero
An empty balance doesn’t always mean theft. Web3Auth said on Saturday it had begun “whitehat recovery activities”, sweeping vulnerable wallets that hadn’t been hit yet by using “the same path of the original attacker.” The funds sit in addresses Web3Auth controls, waiting for a way back to their owners.
That confused the first onchain counts. Bitquery traced $6.01 million out of 44,041 Keplr wallets on seven Cosmos chains and 7,603 on Injective, and called it a drain. It later rewrote its report after Web3Auth said those addresses were its own recovery wallets.
Web3Auth then posted the verified list on Sunday:
Update on Keplr asset recovery:
As part of our ongoing response to the security incident affecting certain Keplr wallets, we have been transferring assets into secure recovery wallets, with assistance from Keplr. 🧵
The biggest is on Cosmos Hub. We checked its balance: 549,460 liquid ATOM plus about 1.96 million ATOM in tokenized staking shares, around $3.4 million at today’s price. Tokenizing the shares let the sweep take staked ATOM without the 21-day wait.
What nobody has said yet is how much the real attacker took. Web3Auth mentions an “original attacker” but no figure, and it hasn’t explained the flaw itself. Keplr hasn’t said how secured funds will be returned.
TRAIL MAP: The 10 Most Common Crypto Scams and How to Spot Them
ATOM Price After the Keplr News
ATOM trades at $1.34 at the time of writing, down 1.11% in 24 hours and 8.33% over the week. It sits well under its 50-day and 200-day moving averages, both near $1.68, with the August low of $1.212 as the next floor.
Google and Apple login on Keplr is still paused, and Web3Auth hasn’t given a date for bringing its service back.
TheCryptoMonk has been trading since 2017 and reads the market from the top down. The focus is macro and the high timeframes: where stocks, rates and liquidity are heading, and what the weekly and monthly charts say about Bitcoin. Short-term noise matters less than the bigger trend.
More from TheCryptoMonk
