On November 8, Web3Auth and Keplr confirmed that some transfers following the Keplr wallet breach were part of recovery efforts rather than further theft. Web3Auth published verified recovery addresses for assets being moved out of affected accounts, including 2,265.59 staked ATOM from six Cosmos Hub accounts.
Keplr confirmed that the listed wallets were authorized recovery destinations. Transfers worth $6.01 million were initially mistaken for theft but were later identified as protective measures. Recovery-phrase and hardware-wallet accounts remained unaffected, according to Keplr.
Web3Auth attributed the breach to a vulnerability in its infrastructure that exposed private keys of some social-login users. Keplr co-founder Josh Lee clarified that the incident did not originate in Keplr’s wallet code and estimated that roughly 20% of Google- and Apple-login accounts were potentially affected.
Keplr advised social-login users to stop depositing into those accounts and transfer remaining liquid assets to accounts secured with a recovery phrase or hardware wallet. Users were also warned to ignore unsolicited recovery service offers and rely on official updates from Keplr and Web3Auth.