SECURITY ALERT · UPDATE 2

The empty wallets have an answer.

Not the one anyone wanted.

The 12 addresses Web3Auth published as its recovery wallets held about $5.6 million on Sunday, according to on-chain data reviewed by The Block, and Keplr’s co-founder says about 20% of its Google and Apple login accounts were affected.

That is the first size anyone has put on the Keplr and Web3Auth incident we have followed since Saturday.

It is not a loss figure. Neither company has put a number on what the original attacker took.

What the records show

Most of it sits on Cosmos Hub. The Block reports about 2.49 million ATOM there, worth roughly $3.3 million.

Much of that ATOM had been staked. The sweeps turned the stakes into tokens that could move at once, instead of waiting out the network’s 21-day withdrawal period.

The on-chain analytics firm Bitquery counted at least 44,041 wallets swept across seven Cosmos chains, plus 7,603 more on Injective. They held $6.01 million at 15:38 UTC on Saturday 7 Nov.

Bitquery’s median wallet sent $1.34. About 88% sent under $100. The largest single wallet sent $325,000.

Bitquery says neither main recovery address has sent a transaction. We have not checked who controls them; Web3Auth’s list is the only source for that.

The two dollar figures are different measurements.

The Block’s $5.6 million covers 12 addresses on Sunday. Bitquery’s $6.01 million covers two addresses on Saturday, at Saturday’s prices. We have not added them.

So which wallets were rescued, and which were robbed?

The timeline, in UTC

  • Fri 6 Nov, 20:52. Bitquery’s first sweep: ten Cosmos Hub wallets each send an amount worth under two cents.
  • Fri 6 Nov, 21:13. Web3Auth pauses its embedded wallet service.
  • Sat 7 Nov, 04:38. Keplr warns users of unauthorised transactions and pauses Google and Apple login. Bitquery counts 86% of the wallets as swept after this warning.
  • Sat 7 Nov, 10:34. Sweeps stop on six chains and Injective within 19 seconds, Bitquery says. They restart on Osmosis at 18:28 and on Noble on Sunday from 16:02.
  • Sat 7 Nov, 16:53 to 17:17. Web3Auth names a security issue in its infrastructure and says it began whitehat recovery of wallets “vulnerable but not yet impacted”. Keplr tells affected users to move remaining funds.
  • Sun 8 Nov, 06:23. Web3Auth publishes the verified recovery addresses.

Web3Auth’s own words, as The Block reports them, are that it used “the same path of the original attacker”.

Keplr co-founder Josh Lee wrote that this was “not a hack of Keplr’s code” and that the incident originated at Web3Auth, according to The Block.

He estimated that about 20% of Keplr’s Google and Apple login accounts were affected, and wrote that only a fraction of them appear to have been exploited.

Who was the original attacker, and what did they reach before the rescue began?

The Ethereum-style address

One address, 0x413e4F4De7E5FF010913488F781E679e76f706dA, covers eight EVM chains on Web3Auth’s list.

Bitquery’s count of wallets that sent funds to it, read at 19:20 UTC on Sunday: Ethereum 1,553, Base 870, Arbitrum 828, BNB Chain 490, Optimism 245, Polygon 4.

These wallets are not in the 44,041. Bitquery’s totals leave them out.

How many people hold keys on more chains than they know?

What is not known yet

Neither company has named the flaw, sized the original attacker’s take, or explained how owners get funds back. Web3Auth says it is working with Keplr on “a path to recovery”.

Bitquery first published on Saturday that an attacker took these funds. It corrected the article on Sunday after Web3Auth called the transfers a rescue, and says so at the top of the page.

That is the whole problem in one correction. On a blockchain, a rescue and a theft look the same.

Protect yourself

  • If your Keplr wallet uses Google or Apple login, do not send new funds to it. Move what remains to a wallet secured by a recovery phrase or a hardware device, Keplr says.
  • A zero balance may mean rescue, not theft. Check any unfamiliar outgoing transfer against Web3Auth’s verified list, and nothing else.
  • Treat any message offering to “recover” your funds as phishing unless it comes from Keplr’s or Web3Auth’s official accounts. Both have warned of impersonators.
  • Learn what a private key is. Social login hides it. It does not remove it.

When the key is rebuilt every time you sign in, who else can rebuild it?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.