Overview
- Web3Auth flagged a security issue and paused its embedded wallet service on November 6, and Keplr suspended Google and Apple social logins after users reported unauthorized transactions.
- Blockchain analytics traced roughly $6.01 million moving from about 44,000 Cosmos‑linked addresses, but that figure is contested because some flows were routed to verified recovery wallets.
- Web3Auth and partner teams began whitehat recoveries using the same access path as the incident, and the company published verified recovery addresses to help distinguish protective transfers from attacker withdrawals.
- Keplr says accounts created with a recovery phrase or a hardware wallet were not affected and is urging social‑login users to stop depositing funds and move liquid assets to seed‑phrase or hardware wallets.
- No final loss tally, root‑cause postmortem, or formal return process has been released yet, and the incident raises broader concerns about concentration risk when many apps rely on one key‑management provider.