Keplr Wallet Hack: Web3Auth Says Flagged Addresses Are Its Recovery Wallets

The Keplr wallet breach targeted individuals who set up their wallets using Google or Apple authentication. According to Web3Auth, a number of addresses previously identified as belonging to the attacker are actually its own recovery wallets.

This distinction is significant for many Cosmos ecosystem participants. Blockchain analytics provider Bitquery linked over $6 million to the exploit. Yet some of that amount might be in wallets that Web3Auth is safeguarding.

How the Keplr Wallet Hack Hit Social Login Users

Web3Auth supplies authentication software that enables applications to generate crypto wallets via social media accounts. On November 6, the firm halted its embedded wallet service and placed its login service under maintenance.

At first, Web3Auth indicated that MetaMask users, who encountered a distinct security event in October, showed no effects. The following day, the company identified the vulnerability in its own systems and verified that certain Keplr wallets were affected.

Subsequently, Keplr deactivated Google and Apple login options. Wallets established using a seed phrase or a hardware device remain secure, according to the Keplr team.

Bitquery tallied approximately 44,700 compromised Keplr wallets spanning eight Cosmos-based blockchains. The biggest individual loss amounted to roughly $325,000.

This breach struck a sector that had already experienced upheaval in 2026. During the spring, the closure of Leap Wallet drove numerous Cosmos users to Keplr.

Rescue or Theft? Why the Addresses Matter

In the meantime, Web3Auth reports that it initiated a whitehat effort alongside its collaborators. The group transferred assets from at-risk wallets ahead of the attacker, employing the same entry method.

Certain onlookers incorrectly viewed those movements as belonging to the Keplr exploit. In reaction, Web3Auth disclosed authenticated addresses across Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM-compatible networks.

Injective
inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g

dYdX
dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt

Babylon bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239

Axelar axelar1atuap9kfnt6y8ykvn3437e7j3z8qffh3y99n9a

Saga
saga1atuap9kfnt6y8ykvn3437e7j3z8qffh37c2ff6

— Web3Auth (@Web3Auth) November 8, 2026

Many of these addresses share a characteristic with aggregation wallets that Bitquery associated with the exploit. Web3Auth has not disclosed the portion of the monitored sum that it protected.

According to Web3Auth, retrieved assets are secure, and the team is collaborating with Keplr to devise a method for their return. The company also cautioned against imposters claiming to provide recovery assistance.

Other initiatives sought to reassure users. PancakeSwap, for instance, stated that its funds and smart contracts are unaffected.

The Keplr wallet breach contributes to a severe year for cryptocurrency security. North Korean cybercriminals alone stole $7.61 billion in 2026. Meanwhile, another assailant drained more than 1,400 Qubic wallets.