Web3Auth disputes $6.01 million Keplr theft estimate, says funds went to recovery wallets

The social-login provider says on-chain movements flagged as theft were partly whitehat recoveries routed to verified addresses Web3Auth is pushing back on a figure that spread fast across crypto circles: a reported $6.01 million theft from Keplr social-login wallets. The company says that estimate was false because the funds in question moved to verified recovery wallets, not to an attacker’s pocket. The dispute matters because it sits on top of a real security incident. A vulnerability in Web3Auth’s services hit Keplr users who signed in with Google and Apple accounts. The open question is how much of the money that left those wallets is actually gone. What happened to Keplr’s social-login wallets The trouble started over November 6 and 7, 2026, when funds began draining from Keplr wallets tied to social logins. Bitquery, a blockchain data provider, tracked more than 44,041 affected wallets in the Cosmos ecosystem. It also tracked 7,603 wallets on Injective, a Cosmos-based chain. Web3Auth confirmed the vulnerability on November 6 and paused its embedded wallet service the same day. Keplr co-founder Josh Lee said the breach came from a flaw in Web3Auth’s services. He said it affec...