Web3Auth says Keplr transfers include recovery moves, with losses still unclear

Web3Auth says it moved assets from exposed Keplr social-login wallets into recovery addresses. The transfers should not all be counted as theft, and recovery is not yet the same as money returned.

The Block reported on 8 November that twelve addresses identified by Web3Auth held roughly $5.6 million at its reporting time. The company said it used the vulnerability to move funds before an attacker could reach them. The amount actually stolen remained undisclosed; the recovery-wallet balance is neither a confirmed loss total nor proof that every affected user is whole.

The incident concerns some Keplr accounts created using Google or Apple login. Keplr said recovery-phrase and hardware-wallet accounts were unaffected. Its published guidance, reported by The Block, was to stop depositing into affected social-login accounts and move remaining funds to a newly secured wallet. Users should obtain the current instructions from the official services, not unsolicited recovery messages.

MetaMask's official 7 November notice confirmed that Web3Auth Embedded Wallets had been paused and said its initial investigation found no evidence that MetaMask users were affected. That is a qualified finding, not a blanket guarantee for every third-party integration. A balance moved to a recovery address still needs a verified return process.