Keplr wallets hit by Web3Auth flaw as funds moved to recovery wallets

Web3Auth moved funds before the attacker reached other wallets

Web3Auth said it used the attacker’s route to empty other at-risk wallets before the attacker got to them. It moved that money, with help from the wallet maker, into recovery wallets for safekeeping.

Bitquery said the first transfers came 21 minutes before the login provider’s first public notice. Its analysis found that 86% of the wallets were emptied after Keplr warned users.

Keplr paused Google and Apple sign-in while investigating

Cointribune said Keplr alerted its users on Nov 7 after detecting unauthorized transactions on accounts created with Google or Apple. Keplr said wallets made with a recovery phrase, a backup list of 12 or 24 words, or a hardware wallet were not affected.

Josh Lee estimated that about 20% of Google and Apple login accounts were affected, and that only a fraction of those appeared to have been exploited. Cointribune said the median loss per wallet was $1.34, while the largest transfer approached $325,000.

Cointribune also said nearly 1.96 million ATOM in staking changed position without the usual 21-day unlocking period through liquid staking.

Keplr paused Google and Apple sign-in while it investigates, and it told users not to send new funds to accounts created through those login methods or recreate the accounts elsewhere.

Web3Auth published recovery addresses holding about $5.6 million, equal to 93.2% of Bitquery’s recorded flows. Cointribune estimated a net loss of $410,000, while noting that the calculation remained approximate because the analyses covered different scopes or periods.