Web3Auth has challenged reports estimating a $6.01 million theft from Keplr wallets. The company claims this figure is inaccurate because a portion of the funds was moved to verified recovery wallets rather than being stolen by attackers.
The security incident occurred on November 6 and 7, 2026, following a vulnerability in Web3Auth services that affected users logging in via Google and Apple accounts. Bitquery reported that over 44,041 wallets in the Cosmos ecosystem and 7,603 wallets on Injective were impacted.
Web3Auth confirmed the vulnerability on November 6 and suspended its embedded wallet service. Keplr co-founder Josh Lee stated that approximately 20% of wallets created through social logins were affected, while accounts using recovery phrases or hardware devices remained secure.
To clarify the situation, Web3Auth published a list of verified recovery addresses across eleven Cosmos-based networks and eight EVM-compatible chains on November 8. The company argues that assets held in these addresses were secured through whitehat recovery operations.
Both Web3Auth and Keplr have advised users to avoid unofficial recovery offers and to rely solely on official communication channels. Keplr further recommended that users stop depositing funds into affected accounts and transfer existing assets to secure wallets.
