At least $6.0M left 44,000+ Keplr wallets that used Google or Apple login, on eight Cosmos chains, for addresses Web3Auth lists as its recovery wallets. It says it moved the coins before the attacker could.
Our first version read these sweeps as the theft. Web3Auth now calls them its rescue. We recount 18 hours of sweeps on eight chains, the way staked coins left without the usual wait, and what nobody has said yet.
The first version of this article, published at 16:41 UTC on 7 November, said an attacker took these funds. Web3Auth and Keplr say that was wrong. Twelve minutes after it went live, Web3Auth said it was securing assets from affected accounts. On 8 November Web3Auth and Keplr listed the receiving addresses as Web3Auth recovery wallets.
We have rewritten the article on that basis. The counts, dollar values and timings for 6 and 7 November are the same measurements as before. New in this version, read on 8 November: the recovery's restart on Osmosis and Noble and the further chains it reached. The first version raised the possibility of a rescue and judged it unlikely.
- $6.01M
- 86%
- 1.96M
- 19 s
- 11
- 0
01 · What happenedKeplr wallets that used Google login were emptied
Late on 6 November, users of Keplr, a crypto wallet app, found their wallets empty. They had signed up the easy way, with a Google or Apple account. Their coins had gone to an address they did not know.
One of them posted the ID of the transfer that emptied their wallet. It went out late on Friday night and moved nine kinds of tokens to that address in one step.
Keplr spoke up at 04:38 UTC the next morning. In a post on X, it said accounts created with Google or Apple login had seen transactions their owners did not make. Wallets backed up with a recovery phrase, the usual list of 12 or 24 words, were not affected, it said, and neither were hardware wallets. Keplr paused the Google and Apple login. Seven hours earlier, Web3Auth, the company behind that login, had reported a security issue. It had paused its embedded wallet service.
We followed the money from that first transfer. Each transfer was a sweep, one transfer that empties a wallet into another address. Addresses that share one key took funds on seven chains in Cosmos, a family of linked blockchains. A second address did the same on Injective. At least 44,041 wallets on the seven chains and 7,603 on Injective sent funds there. The two addresses held about $6.01M when we counted. Our first version said they belonged to the attacker.
Twelve minutes after that version went live, Web3Auth said it was working to secure assets from affected accounts, with help from Keplr. Thirteen minutes later it said it had begun a "whitehat recovery". Its targets were wallets that were "vulnerable but not yet impacted", and it used the same path as the original attacker. On 8 November Web3Auth posted a list of what it calls verified recovery addresses, used to secure affected assets. Keplr posted the same list. Both of our addresses are on it.
So, on Web3Auth's word, the $6.01M sits in its recovery wallets. That covers the very first sweep, 21 minutes before Web3Auth's first public notice, and the transfer the user posted. We cannot check who holds these wallets. Neither company has named an address of the original attacker or said how much it took. Our count starts from the recovery wallets, so it cannot see wallets the attacker emptied elsewhere.
02 · The loginWhat Keplr social login is, and where Web3Auth fits
Keplr is a wallet app for Cosmos, a family of linked blockchains that includes Cosmos Hub, Osmosis and Celestia. Like any crypto wallet, it rests on a private key, a secret number that signs every payment. Whoever holds the key holds the money.
Most Keplr users keep that key as a recovery phrase, 12 or 24 words written down somewhere safe. Keplr also offers a shortcut, called social login: sign in with Google or Apple and never see the words. Web3Auth runs that sign-in. It is a login service for crypto apps. In 2025 it joined Consensys, the company behind MetaMask. The service rebuilds the wallet's key each time the user signs in. The user never has to keep it.
On Cosmos chains, one key opens an address on every chain at once. Only the start of the address changes, such as cosmos1 on Cosmos Hub and osmo1 on Osmosis. So whoever can sign with a key can empty every chain the owner used, in one sitting.
Web3Auth says the security issue sat in its own systems and hit embedded wallets used by Keplr. It has not said what the opening was. The ledger shows what it allowed. Someone other than the owners could sign for these wallets. Web3Auth says the original attacker used that path first, and its recovery then signed for the wallets the same way.
03 · The moneyTwo Web3Auth recovery wallets, eight chains
A Cosmos address looks almost the same on every chain, since only the start and the last six characters change. That tied the addresses together before Web3Auth named them. The one that received the first user's tokens, on Osmosis, has twins on Cosmos Hub, Celestia, Akash, Noble, dYdX and Babylon. All seven received funds. A second recovery wallet did the same job on Injective.
Cosmos Hub holds the most, $3.50M, nearly all of it in ATOM, the chain's own coin. Osmosis comes next, with more than a thousand kinds of tokens, from USDC and bitcoin to pool shares.
Neither address has sent a single transaction on any chain. On the chains where the sweeps had stopped when we counted, we added up every transfer in and compared it with the balance. They match to the last unit. Nothing has left.
04 · The walletsMost Keplr wallets held a little, a few held a lot
Most wallets held little. The median wallet sent $1.34, and 88% sent under $100. A few dozen large wallets carry a third of the total between them. The biggest single wallet sent $325K.
Because one key opened every chain, many people had funds moved on more than one chain. 46% of the wallets sent funds on two or more chains.
05 · The timingMost of the recovery came after Keplr's warning
The first sweep came at 20:52 UTC on Friday. Within seconds, 10 Cosmos Hub wallets each sent the same tiny amount, worth under 2 cents. It looks like a test. Web3Auth posted its first notice 21 minutes later.
The first wave hit Cosmos Hub, Osmosis, Celestia and Akash before midnight. The night was quieter. Keplr warned its users at 04:38 UTC, and two hours later the biggest wave began, six times the size of the first.
Counted by wallet, 86% of the wallets on the seven same-key chains had their funds moved after Keplr's warning. Web3Auth says its recovery targeted wallets that were "vulnerable but not yet impacted". Its other posts speak of "affected accounts". A rescue sweep and a theft look the same on a blockchain. The ledger cannot show which wallets the attacker had reached.
Then, just after 10:34 UTC, the sweeps stopped on six chains and on Injective within the same 19 seconds. Only Cosmos Hub went on, where staked ATOM was still being moved, until 15:33 UTC.
The pause did not last. From 18:28 UTC on 7 November the recovery came back on Osmosis, this time for coins locked in trading pools. The key that covered the network costs on Cosmos Hub now co-signs transactions on Osmosis that close a user's pool position, release locked pool shares and send the proceeds to the recovery wallet. By 19:22 UTC on 8 November the Osmosis address had taken in 4,568 more transfers. Noble took 183 more from 16:02 UTC on 8 November. None of that is in our totals.
The recovery also reached chains our count leaves out. Web3Auth lists an Ethereum-style recovery wallet, 0x413e…06dA, for eight chains, and it began taking in funds at 16:43 UTC on 7 November. We can read six of those chains, among them Arbitrum, Optimism and Polygon. From 17:51 UTC the same recovery key that runs on seven Cosmos chains also took in funds on Axelar, Saga and Agoric. None of these addresses has sent anything.
| Wallets that sent funds to 0x413e…06dA (read 8 November, 19:20 UTC) | Wallets |
|---|---|
| Ethereum (first transfer 7 Nov, 16:43) | 1,553 |
| Base (first transfer 7 Nov, 17:54) | 870 |
| Arbitrum (first transfer 7 Nov, 18:03) | 828 |
| BNB Chain (first transfer 7 Nov, 19:00) | 490 |
| Optimism (first transfer 7 Nov, 16:53) | 245 |
| Polygon (first transfer 8 Nov, 18:12) | 4 |
You can follow that address with the Bitquery MCP to see whether it ever sends funds out.
06 · The stakeHow staked ATOM left without the 21-day wait
Many Cosmos users stake their ATOM. They lock it with a validator, one of the computers that run the chain, and earn rewards in return. Getting staked ATOM back normally takes 21 days, a wait called unbonding. That wait would have kept the stake inside the exposed wallets.
Cosmos Hub has a feature that skips it, built for liquid staking, where a token stands in for a stake so the stake can be traded. A staker can turn a stake into a share token, which stands for the staked ATOM and moves like any other coin. The recovery moved staked ATOM this way.
From 09:57 UTC on Saturday the sweeps packed wallets into bundles of up to six each. A separate gas wallet paid the fee. Each bundle did three things to every wallet in it.
First it pointed the wallet's staking rewards at the recovery wallet. Then it turned the stake into a share token and sent the token there too. Bundles had done this to 13,030 wallets by the time we stopped counting.
Turning a stake into a token also pays out the rewards it has earned. Those rewards went there as well, worth about $251K.
The share tokens turn back into ATOM only after the same 21 days, or through a liquid staking service that takes them. Web3Auth has not said how it will return the coins, or when. It says parts of the recovery are complex and may take time.
07 · InjectiveA second recovery wallet on Injective
Injective is another Cosmos chain, but its addresses look like Ethereum's. So the same key gives an address there that looks nothing like the others. We found it by checking the largest wallets one by one. Of the 39 we checked, 11 had sent funds on Injective, and all 11 had sent them to one address, which starts inj1lqmdmu.
That address received funds from 7,603 wallets on Saturday morning and now holds $615K, mostly in USDT and INJ, Injective's own coin. It has sent nothing.
The wallets match. Nine in ten of the Injective wallets, in a sample we checked, had also sent funds on the other seven chains. The clocks match too. The Injective address had its biggest burst in the same morning hour, and its last sweep landed in the same second as the last ones on Akash, Noble and dYdX. Web3Auth's list now confirms the link. Both addresses are on it. Injective adds about 690 new wallets, which brings the total to about 44,700.
An Injective address is also an Ethereum address in disguise. We checked this one, 0xf836dd…ac29, with Bitquery data on Ethereum, Base, BNB Chain and Arbitrum. It has no activity on any of them. Web3Auth's Ethereum-style address is a different one.
08 · What nowWhat Keplr users can do now
If your wallet sent funds to one of the recovery wallets in the record below, Web3Auth says those funds sit with it. It has not said how or when it will return them.
Keplr's advice stands. Send nothing new to a social-login account, and do not import it anywhere else. A wallet whose reward address now points at a recovery wallet keeps sending its staking rewards there, and changing that setting means signing with the exposed key. Any new funds belong in a new wallet with its own recovery phrase.
Both companies warn about impersonators. Keplr points users to Web3Auth's official channels for recovery updates and warns of fraudulent recovery requests.
The attacker's side is still unknown. Neither company has said how many wallets the original attacker emptied or how much it took, and neither has named an attacker address. Our data cannot settle it.
09 · CheckedWhat we checked and did not find
Keplr can also hold coins on Ethereum-style chains, so we looked there. A wallet's Ethereum address can be worked out from the public key its own transactions reveal, so we did that for the largest wallets. Up to 13:05 UTC on 7 November, none of them had sent anything on Ethereum. Web3Auth's Ethereum-style address started taking in funds later that afternoon.
The first recovery wallet's key, written as a Bitcoin address, bc1qatuap9…ds23, has no activity in our Bitcoin data.
When we checked on 7 November, the same key held nothing on 33 other Cosmos chains, including Stride, Neutron, Juno, Axelar, Saga, Sei and Kava. Axelar and Saga have since received funds, from 17:51 UTC. The 39 largest wallets sent nothing on Stride, Neutron or Juno, so no other address shows up there. We could not read 14 other chains.
10 · MethodHow we measured it
We read the eight Cosmos chains from public nodes. For each address we pulled every transfer into it, up to 15:38 UTC on 7 November, then compared the total with its balance. On 8 November we counted again. Cosmos Hub had no new sweeps. Its one new transfer was staking rewards, paid out when a swept wallet unstaked some ATOM. Osmosis and Noble had the new sweeps described above. Prices are spot prices from the afternoon of 7 November, from CoinGecko for the main coins and from the Osmosis price service for Osmosis tokens. Staking share tokens are valued at their validator's exchange rate.
A wallet here means one private key, counted once however many chains it sent funds on. We left out 45,000 "USDC" in the Cosmos Hub address. It arrived as 45 transfers of exactly 1,000 through an unusual route, the mark of a spam token. Tokens with no market price are also left out, so the dollar total is a floor.
The recovery wallets are Web3Auth's on the word of Web3Auth and Keplr. We did not check who holds these keys, and a blockchain cannot show it. Every address in our count is on the list both companies posted. The gas wallet is missing from that list. It signed every recovery bundle, so we count it as part of the same effort. For the Ethereum-style and Bitcoin checks we used Bitquery's own data. It is also sold as files on the Bitquery Data Store, as the Ethereum and Bitcoin datasets.
Transfers on the eight chains were read up to 15:38 UTC on 7 November. Recounts on 8 November found the recovery had restarted on Osmosis and Noble. Those transfers are not in our totals.
A wallet means one private key, counted once. The seven chains that share one recovery-wallet key give an exact count of 44,041 as of 15:38 UTC on 7 November. Injective addresses use a different format, so its extra wallets are an estimate from a sample of 299 wallets, between 440 and 934.
Dollar values use spot prices at 15:27 UTC on 7 November, not prices at the time of each sweep. Tokens with no market price, and 45,000 likely spam USDC, are left out.
Staking share tokens are valued at their validator's exchange rate. They turn back into ATOM only after 21 days.
A blockchain does not record who controls an address. The recovery wallets are Web3Auth's on the word of Web3Auth and Keplr; we did not check it. The gas wallet is our attribution: it signed every recovery bundle.
Web3Auth lists recovery addresses on Axelar, Saga, Agoric and eight Ethereum-style chains. We counted the wallets that sent funds to its Ethereum-style address on the six of those chains we can read, and valued none of it.
We could not read 14 other Cosmos chains, and we checked Ethereum-style chains and Bitcoin only for the 39 largest wallets.
11 · The recordAddresses behind this story
Every address below, except the gas wallet and the transfer ID at the end, is on the list Web3Auth posted. The Cosmos addresses are not linked; each one can be looked up on any Cosmos explorer, such as Mintscan.
FAQ
Was Keplr hacked?
Keplr says unauthorized transactions hit accounts made with Google or Apple login, which run on Web3Auth. Web3Auth says the security issue was in its own systems. Keplr says wallets made with a recovery phrase or a hardware wallet were not affected. Neither company has said how the keys were exposed.
Is Keplr wallet safe to use?
Keplr says wallets made with a recovery phrase or a hardware wallet were not affected, and it has paused Google and Apple login. A blockchain does not record how a wallet was created, so we cannot check that claim wallet by wallet. We started from the recovery wallets, so our count cannot see wallets the original attacker emptied elsewhere.
How much was taken in the Keplr wallet hack?
Nobody has said. Web3Auth has given no figure for the original attacker and named none of its addresses. What we can count is the recovery. At least $6.01M at prices on 7 November moved from at least 44,041 wallets on seven Cosmos chains and 7,603 on Injective. The recovery later came back on Osmosis and Noble and reached more chains, which that total leaves out.
What is Web3Auth?
Web3Auth is a login service for crypto apps, part of Consensys since 2025. It lets people open a wallet through social login instead of a recovery phrase. It paused its embedded wallet service on 6 November after what it called a security issue. The sweeps into what it now lists as its recovery wallets had begun 21 minutes before that notice.
Where are the funds from my Keplr wallet?
If your wallet sent its funds to one of the recovery wallets in the record above, Web3Auth says they sit with it. Web3Auth says the recovery is ongoing and parts of it may take time. Follow its official channels and Keplr's, and ignore anyone else who offers to get funds back.
What should I do if I used Google or Apple login with Keplr?
Follow Keplr's advice: send no new funds to that account, do not import it anywhere else, and ignore messages that offer recovery. Trust updates only from Keplr's and Web3Auth's own accounts.
Check a wallet across chains in plain English
The cross-checks in this story, on Ethereum, Base, BNB Chain, Arbitrum and Bitcoin, use Bitquery's data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask whether a wallet moved funds after a given time, or where the funds went next, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum and Bitcoin datasets.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any wallet, login service, exchange or protocol.
The findings describe transactions and balances observed on Cosmos Hub, Osmosis, Celestia, Akash, Noble, dYdX, Babylon and Injective on 6 and 7 November 2026, with checks on Ethereum, Arbitrum, Base, BNB Chain, Optimism, Polygon, Axelar, Saga, Agoric and Bitcoin on 7 and 8 November. The recovery wallets are attributed to Web3Auth on the strength of public statements by Web3Auth and Keplr. Attributions may be incomplete or incorrect and may be revised as more data becomes available.
References to Keplr, Web3Auth, Consensys, MetaMask, Google, Apple, Mintscan, CoinGecko or any other named project, company or service describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices or conduct, and nothing here asserts that any named party acted unlawfully or negligently. Wallet owners are identified by wallet address only.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.