Web3Auth and Keplr published a verified list of recovery-wallet addresses on November 8, complicating an early estimate that more than $6 million had been stolen from Keplr users whose accounts relied on Google or Apple login. The disclosure identifies destinations the companies say hold assets moved for protection, but it does not establish how much money was actually stolen or ultimately secured.
In Keplr’s November 8 recovery notice, the wallet provider attributed the listed addresses to Web3Auth’s safeguarding operation rather than malicious activity. Web3Auth’s official updates describe transfers from vulnerable wallets into secure recovery destinations with Keplr’s assistance. The clarification came after on-chain movements were interpreted as attacker-controlled transfers.
Official Recovery Addresses Change Interpretation Of Wallet Transfers
The published addresses span Cosmos market price and chart Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, alongside one EVM address that Web3Auth says is used across eight networks. Several Cosmos addresses share a corresponding underlying account identifier despite different network-specific prefixes.
For investigators, this matters because an outgoing transfer alone cannot identify the party controlling its destination. A legitimate whitehat recovery and unauthorized theft can both produce sudden balance reductions and large transfers into collection wallets. The account owner’s loss of access is genuine in either case, while the final ownership of the destination determines whether an amount is recovered or stolen.
| Network | Company-identified recovery destination |
|---|---|
| Cosmos Hub | cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu |
| Osmosis | osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw |
| Celestia | celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53 |
| EVM networks | 0x413e4F4De7E5FF010913488F781E679e76f706dA |
These are publicly identified recovery destinations, not deposit addresses or instructions to transfer funds. BlockBriefing has not independently established who controls their signing keys or reconciled all balances against the claimed loss.
Bitquery Figures Cannot Yet Establish Final Theft Amount
Bitquery’s November 7 on-chain investigation attributed approximately $6.01 million in transfers to what it described as an attacker drain affecting tens of thousands of wallets. Its published analysis included several Cosmos-based networks and claims involving staked ATOM. Those estimates preceded the November 8 clarification of the protective recovery destinations.
Because the two companies have not disclosed a complete recovered-versus-stolen reconciliation, the earlier transfer total should not be presented as confirmed irrecoverable losses. Neither the count of affected addresses nor the value of assets moved can independently establish the number of people financially harmed: one user may operate multiple accounts, and some transfers may represent defensive action.
Social Login Wallet Users Face Different Security Exposure
Keplr’s incident notices say the vulnerability affected certain Google- and Apple-login wallets connected to Web3Auth infrastructure, while wallets originally created with a recovery phrase or hardware device were not affected under the company’s assessment. Keplr paused the affected login methods and advised users not to send additional funds to potentially vulnerable accounts.
The companies also said staked and locked balances make recovery more complicated. An account displaying a reduced or empty balance may have experienced a whitehat transfer, an unauthorized transfer or another account-specific event. Users need authenticated transaction and recovery information before concluding which occurred.
Users Still Need Verified Recovery And Claims Details
The remaining questions concern a validated loss amount, the custody and audit of assets held in recovery wallets, eligibility checks and the process for returning control to affected users. No complete independent reconciliation or final reimbursement procedure was established by the November 8 address list.
Both teams warned about impersonators and fraudulent recovery offers. Their official messages do not ask users to send assets to the published destinations. Additional context on evaluating wallet risks is available in BlockBriefing’s hardware versus software wallet guide.
Reporting note: Address labels reflect Web3Auth and Keplr statements. Bitquery’s earlier estimate is identified as an investigator’s calculation, not a verified final loss. No recovery or reimbursement has been independently certified in this report.