Web3Auth is disputing a widely circulated estimate that $6.01 million was stolen from Keplr social-login wallets, arguing that the figure incorrectly counted funds that were moved to verified recovery wallets rather than to an attacker.
The dispute follows a real security incident involving a vulnerability in Web3Auth’s services that affected Keplr users who signed in with Google and Apple accounts. The key question is how much of the money that left those wallets is actually gone.
What happened to Keplr’s social-login wallets
Funds began draining from Keplr wallets tied to social logins over November 6 and 7, 2026. Blockchain data provider Bitquery tracked more than 44,041 affected wallets in the Cosmos ecosystem and 7,603 wallets on Injective, a Cosmos-based chain.
Web3Auth confirmed the vulnerability on November 6 and paused its embedded wallet service the same day. Keplr co-founder Josh Lee said the breach stemmed from a flaw in Web3Auth’s services and affected roughly 20% of wallets created through Google and Apple logins.
Wallets created with recovery phrases or hardware devices showed no signs of compromise, according to Keplr.
Social-login wallets let users open a crypto account with a Gmail or Apple ID instead of writing down a seed phrase. A third-party provider, Web3Auth in this case, handles key management behind the scenes.
Why the $6.01 million figure is contested
The $6.01 million figure came from tallying funds that flowed out of affected wallets during the incident window. Web3Auth argues that tally included the wrong transactions: some on-chain movements labeled as theft were actually protective “whitehat” recoveries carried out by Web3Auth and its partners.
The confusion arose because the recovery operations used the same technical routes as the initial attacks, making a rescue and a robbery look nearly identical on-chain.
By November 8, Web3Auth had published a list of verified recovery addresses covering eleven Cosmos-based networks and eight EVM-compatible chains. The goal was to let users and analysts confirm that recovered assets landed in wallets the company controls.
Web3Auth points to that list when it calls the $6.01 million estimate false. If the money sits in those addresses, the company’s argument goes, it was not stolen.
Official channels only
Both Web3Auth and Keplr told users to ignore unofficial recovery offers and to rely only on the companies’ own channels for updates and guidance. Keplr also advised users to stop depositing new funds into affected accounts and to move assets to secure accounts in the meantime.
What this means for social-login wallets
When a user holds their own recovery phrase or a hardware device, their security depends mostly on them. When a provider manages the keys, a single flaw upstream can reach thousands of wallets at once. Keplr’s guidance underlined that split, since phrase-based and hardware wallets came through untouched.
The dispute over the number also highlights a weakness in how crypto incidents are measured in real time. On-chain analytics are fast and transparent, but they show movement, not intent. A rescue that mirrors an attack will be counted as an attack until someone with more context says otherwise.
That cuts both ways. Early estimates can overstate damage, as Web3Auth argues happened here. But a company’s own accounting of its incident also deserves scrutiny, which is why the published recovery addresses matter: they let outsiders check the claim rather than take it on faith.
