A critical security flaw within the underlying infrastructure of Web3Auth has triggered widespread fund movements across Keplr, the dominant multi-chain wallet for the Cosmos ecosystem. On-chain forensic investigations published by blockchain analytics firm Bitquery revealed that an attacker exploited exposed cryptographic private keys belonging to Keplr accounts created via Google and Apple social login services. The unauthorized sweeps drained funds from at least 44,041 distinct wallets across seven interconnected Cosmos blockchains, with deduplicated on-chain models estimating approximately 44,700 affected private keys. Total observed on-chain transfers reached at least $6.01 million based on spot valuations on November 7. However, the nature of the incident escalated into a complex confrontation between malicious exploitation and proactive whitehat asset preservation, after Web3Auth confirmed that its internal response teams coordinated fund migrations to protect endangered user balances.
Social Login Key Exposure Hits 44,700 Cosmos Wallets
Private Key Exposure Hits 44,700 Cosmos Wallets via Social Login Vulnerability
The crisis originated within Web3Auth, an embedded authentication and key-management infrastructure provider that was acquired by MetaMask parent company Consensys in 2025. Web3Auth allows decentralized applications and Web3 wallets to onboard non-technical users through standard social logins, dynamically reconstructing user keys on demand without requiring individuals to write down traditional 12- or 24-word seed phrases. On November 6, Web3Auth detected an anomaly across its underlying services, prompting the company to pause its embedded wallet operations and place the authentication gateway into maintenance mode. Despite these measures, private keys tied to specific social-login deployments were compromised. Josh Lee, co-founder of Chainapsis, the development entity behind Keplr, subsequently clarified that the vulnerability existed entirely within Web3Auth's external infrastructure rather than Keplr's client-side software codebase, estimating that roughly 20% of all social-login accounts were exposed to the risk.
Because the Cosmos Inter-Blockchain Communication architecture enables a single cryptographic private key to derive and control equivalent addresses across disparate application-specific blockchains, the exposure had multi-network ramifications. Drain activities rapidly surfaced across eight prominent Cosmos ecosystems, including Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, and Babylon. On-chain transaction logs analyzed by Bitquery showed that the attacker deployed automated execution routines, utilizing dedicated gas wallets to bundle transfers from up to six compromised victim accounts in single transactions. While the median loss per drained wallet was limited to $1.34, the single largest individual loss climbed to approximately $325,000. Significantly, on-chain timeline analysis demonstrated that 86% of victim wallets on the primary linked networks experienced sweeps after Keplr published an urgent public warning at 04:38 UTC on November 7. Pausing frontend social authentication failed to arrest the exploit because the underlying private keys were already in the possession of automated execution scripts.
Liquid Staking Bypass Moves 1.96M Staked ATOM
Liquid Staking Exploitation Bypasses the 21-Day Cosmos Unbonding Period
The technical execution of the asset sweeps highlighted acute operational vulnerabilities surrounding decentralized liquid staking protocols. Under conventional network rules on Cosmos Hub, staked ATOM tokens are subject to a mandatory 21-day unbonding period during which assets cannot be transferred, liquidated, or traded. To circumvent this protective time delay, the automated draining scripts programmatically initiated tokenization requests supported by Cosmos Hub's native liquid staking module. By converting active validator delegations directly into transferable liquid staking share tokens, the draining operations instantly mobilized the underlying principal without waiting for the 21-day lockup to expire.
Forensic data confirmed that 1.96 million staked ATOM were extracted through this liquid staking bypass across 13,030 victim wallets. In executing the conversion, the scripts systematically harvested accrued staking rewards, redirecting approximately $251,000 in generated yield directly into designated collection addresses. In parallel, 81,006 USDC stationed on the Noble network was consolidated into an exploit destination, representing an isolated segment of funds that central stablecoin issuer Circle retains the technical capability to freeze. At the ecosystem level, Cosmos Hub suffered the heaviest concentration of transfers at approximately $3.50 million, followed by Osmosis with $1.04 million and Injective with $615,000 in total swept volume.
Web3Auth Whitehat Recovery Verified by Keplr Ledger
Whitehat Defense Operations and Coordinated Recovery Verification
The trajectory of the incident shifted markedly following official disclosures from Web3Auth and Keplr regarding defensive remediation measures. Web3Auth publicly disputed the narrative that the full $6.01 million sum represented unrecoverable criminal theft, disclosing that its engineering team had initiated emergency whitehat recovery procedures alongside ecosystem partners. Utilizing the identical infrastructure authorization channels exposed by the vulnerability, whitehat engineers swept assets from vulnerable addresses into cold storage custody before external malicious actors could extract them.
On November 8, Keplr officially verified and released a comprehensive public ledger detailing Web3Auth's authorized recovery addresses, explicitly stating: “Web3Auth has verified the following addresses as related to the recovery efforts, not malicious/exploit addresses”. The designated custody destinations span major Cosmos chains including Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, and Agoric, alongside an EVM-compatible address. Web3Auth corroborated the collaborative engagement, stating: “we have been transferring assets into secure recovery wallets, with assistance from Keplr.” As forensic investigators reconcile genuine theft volumes against whitehat custody balances, Keplr urged all users who configured accounts via Google or Apple logins to cease depositing assets, migrate residual liquidity to fresh hardware or mnemonic wallets, and disregard fraudulent phishing campaigns circulating across social platforms.
