Overview
- The breach traced to Web3Auth affected accounts created with Google or Apple sign‑in over Nov. 6–7 and led Keplr to pause those login options while it investigates.
- Blockchain analysis by Bitquery linked about $6.01 million in transfers across roughly 44,000–45,000 wallets and found 1.96 million staked ATOM moved through staking‑share tokenization.
- Keplr’s co‑founder said the problem originated in Web3Auth infrastructure rather than Keplr’s code and estimated roughly 20% of social‑login accounts could be exposed with only a fraction evidently exploited so far.
- Web3Auth and partners have begun whitehat recovery operations to protect vulnerable funds, and companies have not yet released a full tally of affected accounts, confirmed losses, the technical root cause, or a restoration timetable.
- The incident highlights the trade‑off in social login key management that shifts key custody to third parties and shows how tokenized staking can move locked positions quickly, which raises new risks for everyday users and for Cosmos ecosystem security practices.