The dispute follows a security vulnerability affecting Keplr accounts created through Google and Apple social logins between November 6 and 7, 2026. While the incident involved unauthorized wallet movements, Web3Auth maintains that some transactions identified as theft were actually part of coordinated recovery operations.
The disagreement raises questions about the actual financial damage caused by the incident and highlights the difficulty of distinguishing malicious transactions from emergency asset recovery operations using blockchain data alone.
Keplr Wallet Vulnerability Affected Thousands of Accounts
The security incident involved Keplr wallets connected through social authentication services. Users who accessed their wallets using Google or Apple accounts relied on Web3Auth infrastructure to manage their private keys.
Blockchain analytics provider Bitquery tracked 44,041 affected wallets across the Cosmos ecosystem, alongside another 7,603 wallets on Injective, a blockchain network built within the Cosmos ecosystem.
Web3Auth confirmed the vulnerability on November 6, 2026, and suspended its embedded wallet service on the same day.
Keplr co-founder Josh Lee previously attributed the incident to a security flaw in Web3Auth's services. He estimated that approximately 20% of wallets created through Google and Apple authentication were affected.
Keplr also distinguished between social-login accounts and wallets established using traditional recovery phrases or hardware devices. According to the wallet provider, there were no indications that the latter categories had been compromised in the incident.
Social-login wallets simplify access by allowing users to authenticate through existing Google or Apple accounts instead of manually storing a 12- or 24-word recovery phrase. However, this arrangement relies on third-party infrastructure to handle wallet key management.
Why Web3Auth Rejects the $6.01 Million Theft Estimate
The disputed $6.01 million figure originated from calculations of cryptocurrency transferred out of affected wallets during the November 6-7 incident window.
Web3Auth argues that this calculation incorrectly classified certain transactions as stolen funds. According to the company, some transfers were conducted as protective recovery operations involving its security team and partners.
These operations, commonly described as whitehat recoveries, were intended to move vulnerable assets into secure wallets before attackers could access them.
However, the recovery transactions reportedly used technical pathways similar to those employed during the initial unauthorized transfers. As a result, blockchain monitoring systems could identify the movements without necessarily determining whether they were malicious or protective.
Web3Auth maintains that funds transferred into verified recovery wallets should not be counted as stolen assets.
By November 8, 2026, the company had published a list of verified recovery addresses covering 11 Cosmos-based networks and eight EVM-compatible chains.
The published addresses are intended to help affected users and independent blockchain analysts determine whether assets identified in suspicious transactions were transferred into wallets controlled by Web3Auth as part of its recovery efforts.
The company has pointed to this information as evidence supporting its position that the widely circulated $6.01 million theft estimate is inaccurate.
Keplr and Web3Auth Warn Against Unofficial Recovery Offers
Both companies have urged affected users to remain cautious about individuals or services offering unofficial wallet recovery assistance.
Keplr and Web3Auth advised users to rely exclusively on their official communication channels for security updates and recovery instructions.
Keplr also recommended that users avoid depositing additional funds into potentially affected accounts and move their assets into secure wallets while the incident is being addressed.
These precautions are particularly relevant for accounts created through Google and Apple authentication, which were the focus of the reported vulnerability.
Keplr Incident Highlights Risks of Third-Party Wallet Infrastructure
The incident illustrates the different security responsibilities associated with traditional self-custody wallets and accounts that depend on external key-management providers.
Users who control their own recovery phrases or hardware wallets retain direct responsibility for protecting their private keys. Social-login wallets, by comparison, rely on third-party infrastructure to facilitate authentication and manage access to cryptographic keys.
While this approach can make cryptocurrency wallets easier to use, vulnerabilities within a shared service can potentially affect thousands of accounts simultaneously.
The dispute over the financial damage also highlights a limitation of blockchain analytics. Public transaction records can establish when assets move and where they are transferred, but they do not independently establish the intent behind every transaction.
A legitimate recovery operation can therefore resemble an unauthorized transfer when viewed solely through on-chain activity.
At the same time, Web3Auth's explanation requires independent scrutiny. Publishing verified recovery addresses provides users and analysts with a way to examine whether the disputed funds reached wallets associated with the recovery operation rather than relying exclusively on the company's statements.
The final financial impact of the Keplr incident remains disputed. Determining the actual losses requires distinguishing assets recovered through protective transfers from cryptocurrency that remains under unauthorized control.
source: cryptobriefing
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.
