Web3Auth Reports $5.6M Recovery, but Keplr Loss Accounting Remains Disputed

What happened: Web3Auth said it moved approximately $5.6 million from exposed Keplr social-login wallets into 12 recovery addresses, describing the operation as an effort to get ahead of attackers. The vulnerability affected wallets created through Google or Apple sign-in using its integration; seed-phrase and hardware-wallet users were unaffected, while Keplr co-founder Josh Lee said approximately 20% of social-login accounts were affected. Bitquery traced approximately $6.01 million in transfers from more than 44,700 wallets to what it described as an original attacker, but Web3Auth disputes that theft estimate and says much of the activity reflects recovery movements.

Why it matters: The central accounting problem is that suspicious transfers and protective transfers can overlap in outside assessments, making it unsafe to add the reported recovery and alleged theft figures together as separate losses. Web3Auth had not publicly supplied transaction hashes connecting all 12 recovery addresses, leaving its account incompletely reconciled with the outside tracing described in the research. The incident also shows why wallet security depends on the particular access mechanism: the reported exposure involved the social-login integration, so conclusions about every Keplr wallet would overstate its scope.

Sources: The Block; Crypto Briefing.