Keplr Publishes Recovery Wallet List After Account Breach

Keplr published a list of recovery wallet addresses at 06:31 UTC on 8th November 2026, saying Web3Auth had verified them as part of its recovery efforts rather than malicious addresses. Eight addresses on the list match collectors that blockchain data provider Bitquery had earlier attributed to an attacker.

Web3Auth's own 06:23 UTC update said it had been transferring assets into secure recovery wallets with Keplr's help. The notices do not establish a final loss or recovery total, or completed repayments to users.

Bitquery's investigation measured transfers to collecting addresses up to 15:38 UTC on 7th November, before the providers disclosed the recovery operation. It reported approximately $6.01 million held at the collectors using that afternoon's prices. The eight matching addresses span Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX and Babylon.

Bitquery explicitly considered the possibility of protective transfers but judged it unlikely because neither company had announced them when its account was written. Keplr's new list directly challenges that attribution. The address matches establish that the two sources describe the same destinations; the identification of their role comes from Keplr and Web3Auth, rather than independent verification of who controls the keys.

Web3Auth, which provides Keplr's social login, said at 17:06 UTC on 7th November that it and partners had begun protective recovery operations on vulnerable wallets that had not yet been affected, using the original attacker's route. It said some recovery transactions had been mistaken for attacker activity and that recovered funds were safe.

Keplr's earlier update said some Google or Apple login accounts could show reduced or empty balances during mitigation. It described a breach of private keys, the secret credentials used to authorise transactions. The team said recovery took longer for staked assets, tokens committed to helping run a blockchain, and other locked assets. Bitquery's staking explanation describes how these commitments differ from freely transferable coins.

The same notice told users with Google or Apple login accounts not to deposit new funds and to move tokens still available to transfer into an account created with a recovery phrase or hardware wallet. Keplr's security documentation describes a recovery phrase as backup words restoring wallet access. A hardware wallet keeps the private key on a separate device that signs transactions. Keplr said wallets originally created by those methods were unaffected, and an affected-account checker was being developed.

That documentation, updated in September 2025, says Google login uses a Web3Auth-generated private key instead of a recovery phrase. Our wallet guide explains why access to an app and control of its signing keys are different questions.

Earlier Flap and Kintsu recovery notices similarly separated website restoration from wallet exposure, although those alerts concerned malicious websites and permissions rather than this reported key breach. Keplr's new address notice directs users to Web3Auth's official updates and warns against impersonators and fraudulent recovery requests.