Keplr Hack

Between November 6 and 8, 2026, a major supply chain security incident affected Keplr Wallet accounts created via Google or Apple social logins, which rely on Web3Auth's embedded authentication infrastructure. While initial reports indicated a multi-million-dollar theft across 44,000+ wallets, verified updates from Web3Auth and Keplr confirmed that the majority of observed on-chain sweep volume—totaling $6.01M across 44,000+ wallets—was executed as an automated whitehat rescue/recovery operation to secure vulnerable, un-drained user accounts before the attacker could reach them. Accounts created using traditional 12/24-word seed phrases or hardware wallets were completely unaffected.

The incident was triggered by an upstream infrastructure vulnerability within Web3Auth's Key Management and Distributed Key Generation (DKG) pipeline for embedded social-login wallets, allowing arbitrary private keys for social-login users to be derived without user consent. After detecting unauthorized transactions on November 6, Web3Auth paused its embedded wallet service, and Keplr suspended Google/Apple logins at 04:38 UTC on November 7. To prevent complete depletion by the attacker, Web3Auth and Keplr launched an automated whitehat counter-sweep using the same derivation pathway, racing to extract funds into verified recovery wallets across eight primary Cosmos chains (including Cosmos Hub, Osmosis, Injective, Celestia, Akash, Noble, dYdX, and Babylon) as well as eight EVM-compatible networks, Axelar, Saga, and Agoric.

To bypass the standard 21-day unbonding period on Cosmos Hub, the whitehat recovery script tokenized 1.96M staked ATOM into liquid share tokens before sweeping them alongside $251K in pending staking rewards. As of November 8, 2026, the $6.01M+ in rescued assets remains dormant in official Web3Auth recovery addresses, with Web3Auth and Keplr establishing a formal fund return process for affected users.

EVM Recovery Address: 0x413e4F4D…f706dA