Web3Auth on Sunday published a list of wallet addresses it says belong to its own recovery effort for affected Keplr accounts. It said some transfers out of those accounts had been “mistaken for attacker activity.” Keplr relayed the same list and called the addresses “related to the recovery efforts, not malicious/exploit addresses.” The wallet labels are company statements, not independent verification of address control or recovered balances. The update concerns how on-chain activity from the incident should be read. It does not report any new losses or a new compromise.
What is new since the initial incident
AltcoinReporter reported on Saturday that Keplr had paused Google and Apple sign-in after unauthorized transactions on some social-login wallets. That incident was tied to Web3Auth, the login provider. Keplr’s early estimate was that about 20% of social-login accounts were affected, and co-founder Josh Lee said only a fraction of those appeared to have been exploited.
Two things have changed since then. Later on Saturday, Web3Auth said that it and its partners “began whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker.” According to that account, the defenders were moving funds out of exposed wallets through the same route the attacker used. To an outside observer, the two kinds of transfer can look alike.
On Sunday, Web3Auth followed up with the list it had promised. “we have been transferring assets into secure recovery wallets, with assistance from Keplr,” the company said. In the next post in the thread, it added: “We are aware that some of these transactions have been mistaken for attacker activity. The following are verified recovery addresses used to secure affected assets, not attacker-controlled wallets.”
The recovery address list
The list covers 11 Cosmos-based networks: Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric. It also includes one EVM address, which Web3Auth says applies to “all 8 chains.” It does not name those eight chains.
Keplr posted the same set about eight minutes later, attributing the verification to Web3Auth. AltcoinReporter compared the 12 addresses in the two companies’ posts character by character, and they match.
AltcoinReporter is not reproducing the addresses and has not independently checked them against on-chain records. That they are recovery wallets rests on the two companies’ statements. Readers checking a transaction should compare the full address against the official posts. A partial match, such as the first and last few characters, is not enough, because attackers often create look-alike addresses.
What the list does and does not settle
The list explains part of the activity, not all of it. Web3Auth said “some” transactions had been misread. It did not say every outflow from affected wallets went to recovery addresses. Lee’s earlier comments indicated that some accounts were actually drained by the attacker. The official updates reviewed provide no total for funds lost to the attacker, total for funds moved into recovery wallets, or count of affected users.
That matters for loss tallies circulating on social media. A dashboard that counts every transfer out of affected accounts as theft would overstate attacker proceeds if recovery transfers are included. A tally that treats all of the flows as recovery would understate them. Until the companies publish their own accounting, totals from third parties should be treated as unconfirmed.
The list is also not final. Web3Auth said it “will update this list as additional addresses are verified.” On Saturday it said: “Parts of the recovery are complex and may take time.” It said it was working with Keplr on “a path to recovery for users,” and that further detail would come once the operations are complete. In the official updates reviewed for this article, neither company provided a timeline, claims process, reimbursement terms or a technical root-cause report.
Scam risk for affected users
Both companies paired the list with impersonation warnings. Web3Auth told users to “beware of impersonators or fraudulent recovery requests.” The addresses are where the companies say they moved assets. They are not a claims portal, and users are not being asked to send anything to them. Any message asking a user to transfer funds to a “recovery” address, or to share a key to get funds back, does not match anything either company has announced.
Keplr reiterated on Saturday that wallets created with a recovery phrase or a hardware wallet are not affected, based on its assessment. Its later Saturday update also warned that staked and locked assets make recovery more complex and take longer, and that a reduced or empty balance may reflect mitigation efforts. Social-login users should consult the latest official guidance rather than assume an earlier notice is the complete response.
FAQ
Are the transfers to these addresses theft? Web3Auth and Keplr say the listed addresses are recovery wallets used to secure affected assets, not attacker-controlled wallets. That is the companies’ statement; AltcoinReporter has not independently verified who controls the addresses on-chain.
Have all Keplr users’ funds been recovered? No such claim has been made. Web3Auth says some transactions were misread as attacker activity, and Keplr co-founder Josh Lee has said some accounts were exploited. The official updates reviewed give no loss total, recovery total or reimbursement plan.
Should I send funds to a recovery address? No. Neither company has asked users to send funds anywhere. Both warn against impersonators and fraudulent recovery requests.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
