- The golden rule
- Safety tips
- Is my wallet at risk?
- Used social login? Act now
- Funds missing?
- What happened
- Recovery wallets
The golden rule
If you never wrote down a 12 or 24 word recovery phrase, you don't fully control your wallet.
Social login wallets feel easy: tap "Continue with Google" and you're in. But there's no recovery phrase for you to keep. Instead, your private key is split up and held by an outside company's network, and rebuilt whenever you log in. If that network is fooled or broken into, someone else can rebuild your key and sign transactions as you. That's exactly what happened here, and Web3Auth's own rescue proves it: it could move funds out of users' wallets without them doing anything.
Social logins are fine for trying an app with a few pounds. They're not for savings.
Safety tips
Use a recovery phrase wallet, ideally a hardware wallet
A Ledger or similar device keeps your key off your phone and computer entirely. In this incident, no recovery phrase or Ledger wallets were affected.
Write your recovery phrase down offline
Paper or metal, stored somewhere safe. Never screenshot it, photograph it, email it, or save it in notes, cloud drives or chat apps.
Never type your phrase into anything
No website, app, airdrop checker, "wallet sync" tool or support agent ever needs it. Anyone asking for it is stealing.
Split spending and savings
Keep a small hot wallet for everyday apps and mints, and keep the bulk in a hardware wallet you rarely connect.
Check what kind of wallet you have
If you signed up with Google, Apple, email or a phone number and never saw a recovery phrase, it's a social or embedded wallet. Move anything valuable out.
Ignore "recovery" and "claim" messages
Scammers follow every incident with fake refund and claim links. Only trust instructions from the wallet's official accounts, and never sign a transaction from a link in a DM.
Bookmark the apps you use
Type addresses yourself or use bookmarks. Search ads and lookalike links are a common way in.
Is my wallet at risk?
| Wallet type | Risk from this incident |
|---|---|
| Keplr with Google or Apple login | At risk. Move funds now, on every chain. |
| Any other wallet or app using Web3Auth social login | Treat as at risk. Web3Auth says the issue hit "some third parties" and paused its embedded wallets. |
| Recovery phrase wallet (Keplr, Leap, Cosmostation, MetaMask and others) | Not affected, per Keplr's assessment. |
| Ledger or other hardware wallet | Not affected. |
Wallets and apps known to use Web3Auth include Keplr's Google and Apple login, MetaMask Embedded Wallets (in-app logins built on Web3Auth), Torus Wallet, the Binance Chain extension wallet's social login, Kukai, Sequence and Skyweaver, and Ubisoft's web3 games. This isn't a full list, and only Keplr is confirmed as affected. Web3Auth says the MetaMask extension and app are not affected. Not sure? Ask your wallet whether it uses Web3Auth.
The same key works on every chain. If your social login key holds anything on Cosmos Hub, Osmosis, Injective, Celestia, Akash, dYdX, Ethereum, Base or anywhere else, all of it is exposed.
Used social login? Act now
Make a new wallet with a recovery phrase or a Ledger
Not another social login.
Move everything across, on every chain
Tokens, NFTs and liquidity positions. Then stop using the old account: don't send new funds to it and don't re-import it anywhere.
Staked ATOM: liquid stake it and move it
Unstaking takes 21 days. Use a liquid staking app's "liquid stake your staked ATOM" option (for example Stride, pSTAKE or Drop) and send the liquid token to your new wallet straight away.
Other staked tokens: start unstaking
INJ takes 21 days and OSMO 14. Move the tokens to your new wallet the moment they unlock.
Funds missing?
- Look up your address on a block explorer such as Mintscan and find where your funds went.
- Sent to one of the recovery wallets below? Your funds were recovered, not stolen. Web3Auth says they're safe and it's working with Keplr on returning them. Wait for instructions from official Keplr and Web3Auth accounts.
- Sent somewhere else? That's likely the real attacker. Contact Keplr support through its official site, and report it: Action Fraud in the UK, the FBI's IC3 in the US.
- Never pay anyone or sign anything to "unlock" or "claim" a refund.
What happened
Keplr's "Log in with Google" and "Log in with Apple" wallets are built on Web3Auth. On 7 November Keplr reported unauthorised transactions, paused social login, and later said about 20% of its social login accounts were affected. Web3Auth paused its embedded wallet service over a security issue affecting "some third parties". Neither has published the root cause yet.
On-chain, a single operator swept funds from tens of thousands of Keplr social login wallets into one set of addresses, starting at 20:52 UTC on 6 November. Later batches tokenised staked ATOM with the memo "lsm recovery", and on the evening of 7 November it began unwinding Osmosis LP and superfluid positions. Nothing was ever moved out.
On 7 November Web3Auth said it and its partners had begun white-hat recovery from vulnerable wallets using the attacker's own path, and on 8 November it published those addresses. They match the wallets everyone had been tracking. The real attacker's losses are separate and haven't been made public.
Web3Auth recovery wallets
Published by @Web3Auth. Balances are approximate, at prices on the morning of 8 November.
| Chain | Address |
|---|---|
| Cosmos HubAbout $3.39M: 533K ATOM plus 1.96M tokenised staked ATOM | cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu |
| OsmosisAbout $1.07M across 1,200+ tokens | osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw |
| InjectiveAbout $612K: 68K INJ plus USDT and USDC | inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g |
| AkashAbout $410K: 651K AKT | akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx |
| CelestiaAbout $233K: 540K TIA | celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53 |
| NobleAbout $110K: USDC, USDN, EURe | noble1atuap9kfnt6y8ykvn3437e7j3z8qffh3ggxnkj |
| dYdXAbout $57K: 612K DYDX | dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt |
| BabylonAbout $15K: 1.41M BABY | bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239 |
Timeline (UTC, same as UK time)
| 8 Nov | Web3Auth publishes its recovery wallet addresses. They match the wallets tracked as the "attacker". |
| 7 Nov, 18:28 to 01:29 | Recovery batches unwind Osmosis LP, superfluid and liquidity positions in about 1,700 transactions. |
| 7 Nov, 17:06 | Web3Auth says it began white-hat recovery from vulnerable wallets and that recovered funds are safe. |
| 7 Nov, afternoon | Keplr pauses Google and Apple login; Web3Auth pauses its embedded wallet service. |
| 7 Nov, 08:55 to 15:33 | Batches labelled "lsm recovery" tokenise staked ATOM into the Cosmos Hub recovery wallet. |
| 7 Nov, morning | Keplr reports unauthorised transactions on some wallets. |
| 7 Nov, 00:29 to 10:34 | Sweeps on Injective, Babylon and other chains. |
| 6 Nov, 20:52 | First sweep into the Cosmos Hub wallet, later confirmed as Web3Auth recovery. |
What we don't know yet
- How the Web3Auth flaw worked.
- How much the real attacker took, and where it went.
- Which other wallets or apps using Web3Auth were affected.
- When and how recovered funds will be returned.
Sources: public chain data, Keplr and Web3Auth statements, and reporting by The Defiant. Figures are approximate. HooTang Clan isn't affiliated with any of the wallets, chains or apps named here, and this isn't financial advice. Questions or corrections? Tell us in our Discord.