Greg Osuri 🇺🇸

Keplr / Web3Auth social-login drain: what the chain shows so far Two different sweepers moved funds out of the affected Keplr social-login accounts. They behave very differently. Labels below are likelihoods drawn from behaviour, not proof of who controls an address. Data to 01:03 UTC on 8 Nov. Sweep counts to 22:28 UTC on 7 Nov. Bottom line An attacker-likely cluster was draining before the reported pause. The earliest drain we attribute to it is 5 Nov, 01:05 UTC. That is about 44 hours before Web3Auth reported pausing its service at 21:13 UTC on 6 Nov. It drained 153 new keys after the pause, all but one before 03:00 UTC on 7 Nov. It swapped most of what it took on Osmosis. It bridged at least $783k toward Ethereum through the public Squid / Axelar route. A separate collector held about $6.13M at 00:39 UTC on 8 Nov. It swept 45,931 keys, 86% of them after Keplr's reported warning at 04:38 UTC on 7 Nov. None of its 11 addresses had sent anything out when checked between 00:51 and 01:03 UTC on 8 Nov. Nothing had been returned to victims. Its Cosmos Hub staking sweeps carry "lsm recovery" memos. That fits the protective transfers Web3Auth has reported. It stays unconfirmed until Web3Auth publishes the recovery address list it has said is coming. The two figures cover different keys: at least 358 drained against 45,931 swept. Do not add them, or read them as stolen versus recovered. Some keys were drained well before the pause. 19 of the 36 keys the attacker-likely cluster drained on 5 Nov were later swept by the separate collector. The first of them was drained at 01:05 UTC on 5 Nov, about 44 hours before the reported pause. If you used Keplr's social login Follow only official Keplr and Web3Auth channels. Nobody legitimate will DM you to return funds. Do not sign in, connect a wallet or sign a "claim" transaction on any link you are sent. Nobody legitimate will ask for a private key, seed phrase or fee.