Web3Auth says it moved approximately $5.6 million in user assets out of Keplr wallets before attackers could drain them, stating that it identified an exposure in the wallet key infrastructure it supports and acted preemptively to protect user funds. The company's account has not been independently verified, and no technical postmortem or on-chain confirmation has been published at the time of writing.

What Web3Auth says happened

According to reporting from The Block, Web3Auth identified a vulnerability affecting Keplr wallets that relied on its key infrastructure, then moved approximately $5.6 million in user assets before any attacker could act. The company characterized the operation as front-running a potential exploit — a term borrowed from MEV (maximal extractable value) mechanics that implies racing an adversary to execute a transaction first. In this context, the term indicates that Web3Auth executed its transfers ahead of any adversarial transaction, rather than attempting to recover funds after a theft.

Web3Auth, formerly known as Torus, provides social login and key management infrastructure used by a range of Web3 applications; its official website is web3auth.io. Keplr is a browser-extension wallet, developed by Chainapsis, that is primarily used to interact with Cosmos-ecosystem chains, including the Cosmos Hub and other Cosmos SDK-based networks. The relationship between the two products means that a flaw in key derivation or custody on Web3Auth's side could affect Keplr users who authenticated through social login rather than self-managed seed phrases.

The reported action, as stated by the company

Web3Auth's claim is that it executed a protective sweep, moving the full $5.6 million across affected wallets to prevent. The number of wallets involved, the specific chains affected, the destination addresses for the moved funds, whether users were notified in advance, and the timing of the sweep relative to any attacker activity are not confirmed in the available reporting.

No block explorer data has been linked to corroborate the transfer scale or destination. Without transaction hashes or wallet addresses, independent verification of the $5.6 million figure and the funds' current location is not possible from public reporting alone.

Why a preemptive fund transfer is a material risk event

When a wallet provider moves user funds without user-initiated transactions, it raises direct questions about the custody model in use. If Web3Auth held or could reconstruct private keys unilaterally, that is by design for social-login wallet architectures, but it also means the provider holds signing authority that users may not have fully understood they were granting. Such architectures, which are commonly built with multi-party computation (MPC) to split key material into shares held by separate parties, are designed so that no single party — neither the user nor the provider — holds the complete private key on its own, and practical custody therefore depends on how key shares are distributed and reconstructed.

The DeFi stack increasingly relies on wallet abstraction layers, social recovery, and key management services to reduce onboarding friction. Those design tradeoffs are legitimate, but incidents like this one clarify the actual trust surface: users of non-custodial wallets that depend on third-party key infrastructure are exposed to that provider's security posture and operational decisions in ways that differ from pure self-custody, where a single seed phrase remains solely in the holder's control. That tradeoff is not theoretical: wallet-level infrastructure failures have precedents in the industry, including the 2022 Slope wallet breach, in which users' seed phrases were captured by a centralized logging service, and the 2023 compromise of Ledger's Connect Kit JavaScript library, which served malicious code to wallets interacting with affected frontends.

Reported exposure versus confirmed loss

Web3Auth's framing implies the funds were at risk but not lost. That distinction matters for assessing protocol risk. If the company successfully front-ran an attacker and all $5.6 million remains recoverable by users, the incident represents a near-miss rather than a realized exploit.

At this stage, no independent source has confirmed either outcome. The account comes from a single party: the infrastructure provider whose key management was implicated. User reports, Keplr's own disclosure, or on-chain data corresponding to the described transfers would each provide stronger evidence for either scenario.

What remains to be confirmed

Several facts that would substantiate Web3Auth's account are absent from current reporting. Each represents an open question that readers can track as the incident develops.

• Root cause disclosure. What was the nature of the exposure — a leaked key, a compromised signing service, or a logic flaw in key derivation? Without this, the scope of wallets at risk cannot be assessed.
• Affected wallet count. How many Keplr wallets were exposed? The $5.6 million figure implies a specific set of wallets, but no count has been reported.
• On-chain transaction data. Block explorer entries showing the transfer volume, source wallets, destination addresses, and timestamps would allow independent verification of both the amount and the timeline relative to any attacker activity.
• Fund repatriation status. Where are the moved funds now — returned to users, held in a multisig, or placed in a recovery contract? The protective intent of the sweep is only fully credible if repatriation is documented.
• Keplr's independent statement. As the wallet interface used by affected users, Keplr's own disclosure would add significant weight to the incident narrative. No separate statement from Keplr has been confirmed in available sources.

The absence of these details does not mean Web3Auth's account is false, but it does mean the incident is currently a single claim from the party most incentivized to frame the outcome as a protective success. Protocol risk assessments for applications built on Web3Auth's key infrastructure should treat this as an open security event until a full postmortem is published.

For users whose wallets may have been affected, the most direct action is to verify fund balances through Cosmos chain explorers and monitor for official communications from both Web3Auth and Keplr. Wallet security in social-login architectures depends on the transparency and incident response quality of the underlying key management layer, and this incident will serve as a data point in that ongoing evaluation.

Source: DefiLiban — Web3Auth Says It Moved $5.6M From Exposed Keplr Wallets