Web3Auth is pushing back on a figure that spread rapidly across crypto circles: a reported $6.01 million theft from Keplr social-login wallets. The company says the estimate was inaccurate because the funds in question moved to verified recovery wallets, not into an attacker's hands.

The dispute matters because it sits on top of a real security incident. A vulnerability in Web3Auth's services hit Keplr users who signed in with Google and Apple accounts, and the open question is how much of the money that left those wallets is actually gone.

What Happened to Keplr's Social-Login Wallets

The trouble began over November 6 and 7, 2026, when funds started draining from Keplr wallets tied to social logins. Bitquery, a blockchain data provider, tracked more than 44,041 affected wallets in the Cosmos ecosystem, along with 7,603 wallets on Injective, a Cosmos-based chain. The outflows were flagged in CryptoBriefing's earlier coverage of the incident.

The affected accounts were those that relied on Web3Auth's infrastructure for sign-in and key management.

Web3Auth confirmed the vulnerability on November 6 and paused its embedded wallet service the same day.

Keplr co-founder Josh Lee said the breach stemmed from a flaw in Web3Auth's services and affected roughly 20% of the wallets created through Google and Apple logins. Wallets created the traditional way showed no signs of compromise. According to Keplr, accounts set up with recovery phrases or hardware devices were safe.

For non-specialists, the setup works like this: a social-login wallet lets a user open a crypto account with a Gmail or Apple ID instead of writing down a 12- or 24-word seed phrase — a sequence of random words that serves as the sole backup for a self-custodied wallet. A third-party provider, Web3Auth in this case, handles the key management behind the scenes, which lowers the barrier to entry but concentrates trust in the provider's infrastructure.

Why the $6.01 Million Figure Is Contested

The $6.01 million number came from tallying funds that flowed out of affected wallets during the incident window. Web3Auth's position is that the tally swept up the wrong transactions. The company says some on-chain movements labeled as theft were actually protective “whitehat” recoveries carried out by Web3Auth and its partners.

The confusion stemmed from how those rescues looked on-chain. The recovery operations used the same technical routes as the initial attacks, so to anyone watching the blockchain, a rescue and a robbery looked nearly identical.

By November 8, Web3Auth had published a list of verified recovery addresses covering eleven Cosmos-based networks and eight EVM-compatible chains. The goal was to let users and analysts confirm that recovered assets landed in wallets the company controls. That list is also what Web3Auth points to when it calls the $6.01 million estimate false: if the money sits in those addresses, the company's argument goes, it was not stolen.

Official Channels Only

Both Web3Auth and Keplr told users to ignore any unofficial recovery offers and to rely only on the companies' own channels for updates and guidance. Keplr also advised users to stop depositing new funds into affected accounts and to move assets to secure accounts in the meantime.

What This Means for Social-Login Wallets

When a user holds their own recovery phrase or hardware device, their security depends mostly on their own practices. When a provider manages the keys, a single flaw upstream can reach thousands of wallets at once. Keplr's own guidance underlined that split, since phrase-based and hardware wallets came through the incident untouched.

The dispute over the number also exposes a weakness in how crypto incidents get measured in real time. On-chain analytics are fast and transparent, but they show movement, not intent. A rescue that mirrors an attack will be counted as an attack until someone with more context says otherwise.

That cuts both ways. Early estimates can overstate damage, as Web3Auth argues happened here. But a company's own accounting of its incident also deserves scrutiny, which is why the published recovery addresses matter: they let outsiders check the claim rather than take it on faith.

Two questions now hang over the incident's next phase: how much of the disputed outflow is ultimately matched to those published recovery addresses, and whether — and when — Web3Auth's paused embedded wallet service comes back online. Both can be tracked through the companies' official channels rather than through unofficial recovery offers.

This article is based on CryptoBriefing's report.