A flaw in the login system that powers Keplr Wallet let a hacker start draining crypto accounts over the weekend, and the company racing to save what’s left is using the exact same backdoor the attacker found. Web3Auth, the Consensys-owned service behind Keplr’s “sign in with Google” option, says it has moved $5.6 million out of exposed wallets into recovery addresses after a thief already pulled roughly $6 million from more than 44,000 accounts.
What actually broke
Web3Auth lets apps offer “sign in with Google” or “sign in with Apple” as a shortcut around the usual 24-word seed phrase crypto wallets normally require. Keplr Wallet, which started out serving the Cosmos ecosystem and now supports EVM chains too, built its social-login option on top of Web3Auth. Consensys bought Web3Auth in June 2025 and now markets the same technology to other apps as “MetaMask Embedded Wallets.”
Late Friday, Web3Auth disclosed a flaw that exposed the private keys of Keplr users who had signed up through Google or Apple rather than with a seed phrase. By Saturday, blockchain analytics firm Bitquery had traced about $6 million moving out of more than 44,000 wallets. Keplr co-founder Josh Lee didn’t mince words about where the fault sat. “This was not a hack of Keplr’s code,” he wrote on X. “The incident originated at Web3Auth, a provider Keplr uses.” Lee estimated roughly 20% of Keplr’s Google and Apple login accounts were exposed, though he added that “it appears only a fraction of that 20% has actually been exploited, and the remaining accounts may be recoverable.”
A rescue that looks a lot like a second hack
Here’s the part confusing plenty of Keplr users right now: Web3Auth’s rescue plan works by moving funds out of exposed wallets without asking the owner first, using the same private-key access the attacker had. The company said Saturday it had started “emptying” vulnerable wallets the attacker hadn’t reached yet, essentially racing the thief to the finish line. By early Sunday it had to walk that back a little: “We are aware that some of these transactions have been mistaken for attacker activity,” Web3Auth said.
That mix-up makes sense once you think about it from a user’s seat. If your Keplr balance hit zero this weekend, the blockchain alone won’t tell you whether a thief took it or Web3Auth swept it to safety. Keplr warned Saturday that some accounts “may already show a reduced or empty balance as a result of these mitigation efforts,” which is a gentler way of saying don’t assume the worst if your wallet looks drained. It might just be sitting in one of Web3Auth’s twelve recovery addresses instead.
Most of that $5.6 million, about 2.49 million ATOM worth roughly $3.3 million, came out of staked positions on Cosmos Hub. Unstaking ATOM normally means waiting out a 21-day lockup. Web3Auth’s sweep converted those holdings into liquid tokens that could move immediately, the same move an attacker would presumably need to make to cash out before anyone noticed.
The number nobody has given yet
For a breach that’s already produced a public recovery effort and several rounds of statements, one basic number is still missing: how much was actually stolen. Web3Auth “has not said how many wallets the attacker hit or how much was taken,” and its own language about keeping funds “away from an attacker” implies some money is already gone without saying how much.
Bitquery’s $6 million figure lumps together everything that moved out of the 44,000-plus exposed wallets, meaning it mixes what the thief actually grabbed with whatever Web3Auth itself swept into recovery addresses first. Those are two very different outcomes for an individual user folded into one headline number, and sorting them out is going to take an actual breakdown from Keplr and Web3Auth rather than another round of reassurance posted to X.
One piece of good news did come through clearly: Web3Auth says it found no evidence that MetaMask users were affected, despite running on the same underlying infrastructure. And Keplr wallets set up the traditional way, with a seed phrase or a hardware device, were never exposed. The flaw only touched the social-login shortcut.
What Keplr is telling users to do
Keplr and Web3Auth have paused new social-login signups and are telling anyone who created a wallet through Google or Apple to stop sending funds into it and move whatever’s left to a wallet secured by a seed phrase or hardware device instead. Both companies say they’re building a way for users to check whether their specific account was among the exposed ones, though neither has given a timeline for when that tool will actually exist.
It’s the kind of weekend that makes the whole pitch behind social-login wallets look shakier in hindsight. The appeal of skipping a seed phrase is that you don’t have to protect 24 random words yourself. The tradeoff, as this incident just demonstrated, is that your wallet’s security now depends entirely on a third party’s backend holding up, and when it doesn’t, there’s no seed phrase to fall back on either.
A rough few weeks for crypto security
Web3Auth and Keplr aren’t the only names stuck in this position lately. Binance’s own incident report on its record $6.3 billion hack, which found attackers used a fake job interview and an internal AI tool to reach wallet infrastructure, was followed barely a week later by its CFO heading out the door. Payments firm Gnosis Pay had to tell customers that a breach of its legacy card system exposed home addresses and card numbers tied to crypto wallets. And Brazilian exchange Mercado Bitcoin discovered its own hack kept draining funds for hours after it told the public the breach was already contained.
The pattern across all of them is the same. The first disclosure almost always understates what actually happened, and the real picture only comes together in pieces over the following days, usually thanks to outside blockchain analytics firms doing the math the companies involved haven’t published themselves.
The bottom line
Web3Auth deserves some credit for moving fast enough to pull $5.6 million out of harm’s way before a thief could grab it too. But telling users “we moved your money without asking, for your own good” is an awkward position to be in on a Sunday afternoon, and it’s not the deal anyone signed up for when they picked “sign in with Google” over writing down a seed phrase. If there’s a lesson here for anyone still weighing convenience against self-custody, it’s that the convenient option only holds up as long as the company behind it never has a bad weekend. This one just did, and the bill is still being counted.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
