Keplr Confirms Web3Auth Recovery Addresses After Wallet Breach

Web3Auth published recovery-wallet addresses on Nov. 8 for assets it says it has been transferring from affected Keplr accounts, with Keplr confirming the list after some recovery transactions were mistaken for attacker activity.

The wallet-infrastructure provider said “we have been transferring assets into secure recovery wallets, with assistance from Keplr.”

“Web3Auth has verified the following addresses as related to the recovery efforts, not malicious/exploit addresses,” Keplr said.

The publication follows the Nov. 7 recovery update, when Web3Auth was still preparing a verified list and urging users not to assume unfamiliar destinations belonged to an attacker.

The list names addresses for Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, plus an EVM address. Users can inspect the full confirmed addresses in Keplr’s post below.

Cosmos Batch Destination Identified

The confirmed Cosmos Hub address is also the recipient of the Nov. 7 batch that moved staking claims from six accounts. That transaction tokenized 2,265.59 staked $ATOM and transferred the resulting share tokens to the listed address, according to The Defiant’s calculation and review of the onchain record.

The destination’s role was unresolved in The Defiant’s earlier report. It is now on both teams’ recovery-address lists.

The Hub’s liquid staking module turns delegations into transferable claims while the underlying $ATOM stays bonded. Those claims can move without waiting through a 21-day unbonding period; the batch did not turn the stake into immediately spendable $ATOM.

Guidance for Social-Login Users

Keplr paused Google and Apple login after reports of unauthorized transactions. It later attributed the incident to a Web3Auth infrastructure vulnerability that exposed private keys for some social-login users. Keplr says accounts created with a recovery phrase or hardware wallet are unaffected.

In its Nov. 7 guidance, Keplr told Google- and Apple-login users not to send new funds to those accounts and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. It warned users to ignore direct messages or links offering recovery and trust only Keplr and Web3Auth’s official updates.

Keplr said staked and locked assets take longer to secure. The teams’ Nov. 8 address updates did not quantify the assets secured or provide a process for returning them to users. Web3Auth said it would expand the list as additional addresses are verified.