$6M Gone in Minutes: Keplr Wallets Are Being Emptied Right Now

Attackers have drained at least $6 million from Keplr wallets across eight Cosmos ecosystem networks, exploiting a security breach tied to Web3Auth infrastructure that most users had no idea existed.

This is not a drill. The exploit is linked to Web3Auth, a widely used Web3 login and key management layer that powers wallet access for thousands of applications. When that layer gets compromised, every wallet that relied on it for key generation or authentication becomes a potential target. And Keplr users are finding that out the hard way.

What Actually Happened

Web3Auth functions as a backend authentication layer, handling private key generation and management for users who log in via social accounts or email. If an attacker gains access at that infrastructure level, they do not need your seed phrase. They already have what they need.

The breach reportedly exposed Keplr wallets connected through this system, allowing attackers to sweep funds across multiple Cosmos chains simultaneously. Eight networks hit. At least $6 million confirmed gone. The full scope is still being counted.

For context, this is not a single-chain, single-protocol hack. This is a credential layer attack, which means the blast radius is wide and the exposure window may still be open.

Who Is Safe and Who Is Not

Trust Wallet has confirmed it is not affected. If you use a hardware wallet or a self-custodied wallet where you hold your own seed phrase and never authenticated through Web3Auth, your funds are likely not at risk from this specific vector.

But if you created or accessed a Keplr wallet using social login or email-based authentication, through any app powered by Web3Auth infrastructure, you need to act immediately.

What You Should Do Right Now

- Move your funds. If your Keplr wallet was ever accessed via social or email login, transfer assets to a fresh self-custodied wallet with a locally generated seed phrase. - Do not wait for confirmation. In exploits like this, the window between discovery and full drainage is measured in hours, not days. - Check all Cosmos holdings. This spans eight networks. IBC-connected assets across the ecosystem are in play. - Watch for official statements. Keplr and Web3Auth communication channels will be the first to confirm the full scope.

The Bigger Picture

This exploit is a brutal reminder that convenience in Web3 carries hidden counterparty risk. Social logins feel seamless until the layer managing your keys gets breached. The Cosmos ecosystem, often praised for its interoperability, just demonstrated why a connected ecosystem also means connected vulnerabilities.

Watch ATOM, OSMO, and related Cosmos tokens for selling pressure as affected users exit. And watch how quickly Web3Auth responds. That response time will tell you everything about whether this category of wallet infrastructure can be trusted going forward.