Web3Auth announces verified recovery addresses for the Keplr wallet security incident

This update shows that Web3Auth and Keplr adopted a “white-hat recovery” approach in their incident response: using the same technical path as the attacker, they proactively moved vulnerable wallet assets that had not yet actually been stolen to controlled recovery wallets. This shortened the attack window, but also caused some transfers to be misjudged as malicious activity by observers or users on-chain, so an address list needed to be published to distinguish legitimate recovery from a real attack.

The root cause of the incident points to a Web3Auth infrastructure vulnerability that exposed private keys in some social-login (Google/Apple) embedded wallets. Such wallets rely on external authentication services for private-key custody or generation logic, rather than users holding seed phrases locally, so a service-side failure can directly turn into asset risk for users. Accounts using seed phrases and hardware wallets were not affected, further confirming that the scope of the problem was concentrated in the embedded/social-login path.

At present, the official side has not disclosed the number of affected accounts, the amount of losses, or the specific proportion of assets that have been successfully recovered. Staked and locked assets increase the complexity of recovery, and some accounts with reduced or emptied balances may include both assets truly stolen and assets transferred away for white-hat protection. Users need to rely on the official address list to verify on-chain activity, rather than judging asset status solely from outgoing transfers.

Overall, this incident highlights how embedded wallets and social login lower the user barrier while shifting key-security responsibility to infrastructure providers. Once a provider has a vulnerability, the recovery process itself also creates on-chain confusion, requiring an additional public address-verification mechanism to maintain the ability of users and ecosystem participants to distinguish between them.

ABAB News · Cognitive Law

• When the threshold for key management is lowered, security responsibility shifts from users to infrastructure providers, and the scope of failure expands accordingly.

• When white-hat recovery and real attacks use the same path, on-chain behavior cannot be judged solely by transfers; official address lists must be used to distinguish them.

• The private-key exposure risk for social-login wallets is concentrated on the server side, while the seed phrase and hardware wallet paths remain isolated.