Keplr Wallet Breach Prompts $6M Recovery Sweep

Web3Auth names Keplr recovery wallets

In a November 7 statement, Web3Auth said it and its partners used “the same path of the original attacker” to reach exposed wallets and move assets before the attacker could. The provider had put its login service into maintenance on November 6. Keplr issued its first public warning at 04:38 UTC the next day.

Keplr published 12 recovery addresses on November 8. All eight destinations that blockchain analytics firm Bitquery initially associated with a theft appeared on that list. In its revised investigation, Bitquery said those addresses held about $6.01 million across eight chains as of 15:38 UTC on November 7. Its estimate of roughly 44,700 wallets counts senders to those addresses, adjusting for overlap between chains.

The Block reviewed the 12 addresses and valued their holdings at about $5.6 million when it published at 18:32 UTC on November 8. The two estimates used different snapshots and address sets. The later valuation does not establish that funds left the recovery wallets.

The same transfers can appear in a user’s wallet history before the user knows who received them. BlockintAI checked an Osmosis transaction posted by a user and found that nine token types went to an address on Keplr’s recovery list. In a separate self-reported $5,000 loss, the investigators traced transfers outside that list but could verify neither the reported loss nor a link to the breach.

Bitquery also recorded renewed transfers to the recovery addresses on Osmosis and Noble after its first count. Its snapshot excluded those later transfers. The researchers could establish where the money went, while identifying who controlled the addresses depended on the companies’ disclosures.

Keplr breach hit Google and Apple sign-in accounts

Keplr co-founder Josh Lee estimated that about 20% of accounts made with Google or Apple sign-in were affected and said the team believed only a fraction of those had been exploited. He traced the issue to Web3Auth. Keplr said wallets set up with a recovery phrase or a hardware wallet were unaffected.

A wallet’s private key authorizes transfers. Under Keplr’s Google sign-in setup, Web3Auth handles the login and the user receives a private key instead of a recovery phrase. A party that gets the key can sign a transfer without using the wallet’s usual login screen. The companies had yet to disclose how the keys were exposed.

Web3Auth said initially that it had found no evidence MetaMask users were affected. In a separate MetaMask staking incident disclosed in September, a validator infrastructure breach diverted some staking rewards and prompted precautionary exits.

Keplr users await an ATOM return plan

Bitquery found about 1.96 million staked ATOM was moved using transferable tokens that represent a stake. This let the recovery team move the positions without waiting the usual 21 days for ATOM to become liquid. Bitquery counted 13,030 wallets in the batches that moved staked positions. Keplr said staked and locked assets made the recovery more complicated. The firms have yet to say whether they will return the share tokens themselves or convert them to ATOM first.

In September, a separate Cosmos Hub recovery put about 1.23 million ATOM from the Neutron attack into a wallet controlled by multiple signers, with refunds subject to a governance vote. In Keplr’s case, Web3Auth said it was working with Keplr on returning assets. The firms have disclosed no comparable approval process.

Keplr advised people who used Google or Apple sign-in to stop adding funds to those accounts and avoid importing them elsewhere. Its subsequent guidance, published November 7, said users should move remaining liquid assets to a wallet created with a recovery phrase or a hardware wallet. Keplr warned against unsolicited recovery messages and said it was working on a way for people to check whether their accounts were affected.

Alternative.me’s Crypto Fear & Greed Index registered 29 on November 9, in its Fear range, up from 28 the day before.

The next disclosures to watch are the return procedure for assets in the recovery wallets and a separate accounting of theft losses. The companies had given neither a timetable for those disclosures nor a date for restoring Google and Apple sign-ins.