Keplr Says Some Emptied Balances Reflect Web3Auth Rescue Moves

Some Keplr wallets created with Google or Apple login may already show a reduced or empty balance because of rescue transfers, Keplr said in a post on X. At 1:23 a.m. ET Sunday, Web3Auth published the recovery addresses holding those funds.

That matters for anyone who opened a Keplr wallet with a social login and saw coins leave. Web3Auth said some of its transfers "have been mistaken for attacker activity."

How a rescue transfer works

Web3Auth said Saturday that it and its partners had begun "whitehat recovery," aimed at wallets that were exposed but not yet drained, "utilizing the same path of the original attacker." In plain terms, defenders used the same weakness to move coins out first, into wallets they control, so an attacker couldn't reach them. Keplr described the flaw as a Web3Auth "infrastructure vulnerability leading to private key breach." Web3Auth runs the login service Keplr uses for Google and Apple sign-ins.

The list covers 11 networks, including Cosmos Hub, Osmosis, Celestia, Injective, dYdX and Noble, plus one address used on eight EVM chains, the networks that run Ethereum-style software. Web3Auth said it will add addresses as they are verified.

What users were told to do

Wallets made with a recovery phrase or a hardware device aren't affected, Keplr said. Social-login users were told not to send new funds to those accounts and to move any remaining liquid assets to a phrase or hardware wallet. Staked and locked tokens take longer to secure, Keplr said.

Neither company has said how many accounts were hit, how much was taken by the attacker or how much was moved to safety. Keplr said it is working with Web3Auth on a way for users to check whether their account is affected, and both said to trust only their official accounts and ignore "recovery" offers by DM.

In our opinion: the address list is the most useful thing either company has published so far, because it lets users tell a rescue from a theft on-chain. The missing numbers are the next test. Until Web3Auth says how much it holds and how users get it back, affected holders can see where their coins went but not when they return.