Keplr advises social login users to transfer remaining liquid assets. TechFlow reports that on November 8, according to an official announcement from Keplr Wallet, a vulnerability in the Web3Auth infrastructure led to the leak of private keys for some Keplr users who logged in using Google or Apple. Keplr is currently assisting in securing the assets of affected users. Keplr advises social login users not to transfer new funds to the affected accounts and to move any remaining liquid assets to accounts created with a mnemonic phrase or hardware wallet. Asset protection measures are still underway, and the processing of staked and locked assets may take longer; some account balance reductions or wipes may be related to these protective measures. Keplr stated that it is collaborating with Web3Auth to determine how users can check if their accounts have been affected. Accounts created using a mnemonic phrase or hardware wallet remain unaffected.

Web3Auth breach hits Keplr social-login wallets across eight Cosmos chains. Keplr has paused Google and Apple sign-ins. Web3Auth disputes a $6M loss estimate and says many of the flagged transfers were moves to its recovery wallets. Attackers drained funds from Keplr wallets that were created with Google or Apple sign-in after a security failure at Web3Auth, the company that manages the keys behind those logins. Keplr has paused both login options. Early on-chain tracking put the outflows at about $6 million, but Web3Auth says that figure is wrong. It says much of the money went to wallets it controls so the assets could be kept safe. The incident shows how one weak point at a provider can expose thousands of wallets at once. What happened. Keplr is a popular wallet for the Cosmos ecosystem, a group of linked blockchains. It offers a "social login" option that lets people open a wallet with an existing Google or Apple account. Users don't have to write down a 12- or 24-word recovery phrase, which is the master backup for a crypto wallet. Behind the scenes, Web3Auth handles the key management. Web3Auth is owned by Consensys. Funds began leaving those wallets over 6 and 7 November. The sources give slightly different timelines. Crypto Briefing reports that Web3Auth confirmed the vulnerability and paused its embedded wallet service on 6 November. Keplr's own security notice, which reported unauthorised transactions on some social-login accounts, is dated 7 November. Keplr co-founder Josh Lee said the problem started at Web3Auth, not in Keplr's code. "This was not a hack of Keplr's code," he said, according to crypto.news. He estimated that about 20% of Keplr's Google and Apple login accounts could be exposed but said only some of those had been exploited. Web3Auth has not said how the attackers got the keys. It also has not published a full list of other apps that use the affected service. The scale, according to on-chain data. Blockchain data firm Bitquery traced about $6.01 million in assets linked to the incident. It found 44,041 wallets across seven Cosmos networks and 7,603 addresses on Injective. Some wallets appear on more than one network, so it estimated about 44,700 distinct wallets. Cosmos Hub accounted for about $3.5 million. The other networks were Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective. Bitquery found that about 86% of affected wallets on the seven linked networks sent funds out after Keplr's first warning, and transfers on Cosmos Hub were still happening on 7 November. Bitquery also recorded transfers of 1.96 million staked ATOM, the native token of Cosmos Hub. Staked tokens are normally locked for 21 days before they can be withdrawn. These transfers used a feature called staking-share tokenisation, which turns a staked position into a transferable token, so they skipped that waiting period. Why Web3Auth disputes the $6 million figure. Web3Auth says the tally treated two different things as theft. On 8 November it said it had been moving assets into secure recovery wallets with Keplr's help. This is a "whitehat" recovery: the defenders move funds out of exposed wallets before attackers can reach them. The recovery teams used the same technical route as the attackers. On the blockchain, a rescue and a theft looked almost the same. "We are aware that some of these transactions have been mistaken for attacker activity," Web3Auth said. Web3Auth published a list of verified recovery addresses covering 11 Cosmos-based networks and eight chains compatible with the Ethereum Virtual Machine (EVM), the software standard used by Ethereum. Two addresses that Bitquery had linked to suspected attacker activity are on the list: a Cosmos Hub wallet tied to about $3.5 million and an Osmosis wallet tied to about $1.04 million. On that basis, Web3Auth calls the $6.01 million estimate false. Neither side has given a final figure. Web3Auth has not said how much the attackers actually took or how much its teams have recovered. The $6.01 million figure is best read as total recorded outflows, not confirmed losses. Web3Auth's claims can be checked against the addresses it has published. Who is and isn't affected. * Keplr social-login wallets: Accounts created with Google or Apple sign-in are the ones at risk. * Keplr recovery-phrase and hardware wallets: Keplr says these were not affected. * MetaMask: Web3Auth said its first investigation found no evidence that MetaMask users were affected. * Trust Wallet: A Trust Wallet representative told U.Today that its products were not affected. * Other apps using Web3Auth: It is not yet confirmed whether other third-party integrations were affected. Keplr and Web3Auth have given the following guidance: * Stop depositing into wallets created with Google or Apple login. Keplr has also advised moving assets to secure accounts. * Don't panic over a low balance yet. Keplr warned that some social-login wallets may show low or empty balances because the funds were moved to recovery wallets. Compare any outgoing transfer with Web3Auth's published recovery addresses. * Expect delays for staked funds. Keplr says staked and locked assets need more complicated recovery steps, so returning them may take longer. * Ignore unofficial recovery offers. Both companies told users to rely only on official Keplr and Web3Auth channels. Scammers often target hack victims by posing as recovery services. The incident also shows a trade-off with social-login wallets. When a provider holds the keys, one flaw on its side can reach every wallet that depends on it. Users who keep their own recovery phrase or a hardware wallet do not share that single point of failure. What to watch. * A final loss figure: Web3Auth has not said how much the attackers took or how much it has recovered. * Reimbursement: Keplr has not said whether users with confirmed losses will be repaid. * A technical post-mortem: Web3Auth has not explained how the keys were exposed or listed every integration that may be affected. * Login restoration: Keplr's Google and Apple logins remain paused until Web3Auth's service is fixed. * Recovery of staked assets: Watch for updates on how staked ATOM and other locked positions will be returned to users. Sources.

ConsenSys, the developer of MetaMask, has acquired Web3Auth to enhance the wallet's user experience and address seed phrase management issues. The deal's amount is undisclosed. Web3Auth, serving 50 million users and supporting over 8200 Web3 apps, will enable wallet creation and recovery using familiar Web2 login methods. The integration will also facilitate non-EVM network support, like Solana and Bitcoin, allowing seamless cross-chain transfers without gas fees.