Keplr's Seedless Wallets Were Sold as Non-Custodial. The Rescue Team Moved Them Anyway.

At about 21:13 UTC on November 6, Web3Auth quietly paused its embedded wallet service, according to Crypto Briefing. Seven hours later, at 04:38 UTC on November 7, Keplr posted its first warning: users who had signed in with Google or Apple were seeing transactions they never made, and those logins were now switched off, per a timeline compiled by Panda Security. Keplr co-founder Josh Lee was quick to draw a line: "This was not a hack of Keplr's code," he said, pointing at Web3Auth, the third-party provider behind those logins, as reported by crypto.news.

By the weekend, blockchain analytics firm Bitquery had tied at least $6.01 million in transfers to the incident, spread across roughly 44,700 wallets on Cosmos Hub, Osmosis, Injective, Celestia, Noble, dYdX and other networks. Then the story took a turn. Web3Auth said much of that money hadn't been stolen at all. It had been moved by Web3Auth's own white-hat team into recovery wallets, using the same access path the attacker used.

That was meant as reassurance. It reads more like a confession.

The rescue proved these wallets were never fully in their owners' hands.

Every account in this story was marketed on the same promise. Web3Auth, which Consensys bought in June 2025, describes itself as a service that lets every user "manage a non-custodial wallet intuitively". Its documentation, now published under the MetaMask Embedded Wallets name, says the private key is distributed "in a non-custodial manner" and that control "always remains in the hands of the user."

The engineering behind that claim is real. The key is split with Shamir's Secret Sharing, and the architecture page says no single party, "including MetaMask or the login provider," can control a wallet with one share. A user needs two of several shares: one tied to the OAuth login and managed across Web3Auth's network, one stored on the user's device, and a backup.

What happened last week is that someone other than the user moved funds out of tens of thousands of these wallets. Twice. First an attacker, then a rescue team.

Web3Auth hasn't explained the breach, but the rescue explains enough.

Neither company has published a technical root cause. Crypto.news notes Web3Auth has not explained the technical entry point, and outlets have described the incident only as private keys being exposed. That leaves a lot unknown, and fairness demands saying so.

But the white-hat operation tells you something the post-mortem may not. Starting around 17:06 UTC on November 7, Web3Auth began moving assets out of wallets that were "vulnerable but not yet impacted," according to the Panda Security timeline, using the same route as the attacker. By November 8 it had published verified recovery addresses on 11 Cosmos networks plus one EVM address covering eight EVM chains, per Bitcoin.com News. Keplr warned that some users would open their wallets to find balances reduced or empty because of these protective transfers.

Think about what that means from the user's chair. You never handed anyone your keys. You never approved a transfer. Your money left anyway, to an address controlled by a company, for your own good. That might be the right call in an emergency. It is not what most people picture when they read the words "non-custodial."

Concede the industry's point: seed phrases lose people money too.

The strongest defense of social login is a good one. Seed phrases are a terrible user experience, and they fail constantly. People lose them, photograph them, store them in cloud notes and type them into phishing sites. When Consensys bought Web3Auth, MetaMask co-founder Dan Finlay framed the deal as smoothing the adoption ramp with a more familiar backup experience. The Block reported MetaMask planned to add social and device logins to reduce seed phrase risk. Those are serious goals.

The damage numbers also argue for calm. Bitquery's median loss per wallet was $1.34. Web3Auth says a large share of the flagged outflows went to its own recovery wallets, including one on Cosmos Hub tied to about $3.5 million and one on Osmosis tied to about $1.04 million, which crypto.news says means the $6.01 million cannot be treated as confirmed theft. If most of the money comes back, the rescue worked.

All true. And none of it touches the core problem. The question was never whether social login is easier. It is whether a wallet that a provider can drain, freeze or rescue should be described with the same word as a wallet nobody else can touch. The recovery-phrase and hardware-wallet accounts in Keplr were untouched. The seedless accounts were the ones a third party could reach, in both directions.

One login provider sits under thousands of apps, and most users don't know it exists.

Here's the part that should worry people outside Cosmos. At the time of the acquisition, Consensys said Web3Auth supported nearly 50 million end users and more than 8,200 dapps. Most of those users signed in to an app, not to Web3Auth. They saw a Google button, not a key management vendor.

Web3Auth said its initial investigation found no evidence that MetaMask users were affected, and it has not published a full list of exposed third-party apps, per crypto.news. As of the latest reports, the embedded wallet service is still paused and no restoration timeline has been given. That pause itself is instructive. When one vendor's status page flips to "security incident," login stops for every app that rented its keys at once.

Lee estimated that about 20% of Keplr's social-login accounts may have been affected, though only a fraction were actually drained. Keplr's advice to everyone else was blunt: stop sending funds to those accounts and move what's left to a recovery-phrase or hardware wallet. In other words, the fix for the seedless wallet was a seed.

The honest label is shared custody, and users deserve to hear it.

Nothing here means embedded wallets should disappear. They solve a real onboarding problem, and a provider that can step in during an attack is a feature some users will gladly pay for. Banks offer exactly that, and nobody calls a bank account self-custody.

The fix is in the label and the disclosure. A wallet built on a login provider's key shares should tell users plainly that a company sits in the path, what that company can and cannot do with their funds, and what happens when that company goes down. "Non-custodial" should be reserved for wallets where the answer to "can anyone else move my money?" is no, not "only in an emergency."

Keplr's users learned the distinction the hard way last week: once from an attacker, and once from the people who came to help. The next embedded wallet incident will hit an app with a bigger brand and less patient users, and they will want to know why nobody told them who else held the keys.