Web3Auth Moves $5.6M From Wallets Hit by Key Leak to Safe Addresses

The significance here is less the dollar figure than the failure mode: a flaw in a login-abstraction service turned social-login convenience into a key-exposure vector, and the recovery is being coordinated on-chain through published addresses rather than through a centralized exchange freeze. The affected population is users who chose Google or Apple sign-in over self-managed keys, a segment that has been growing precisely because it lowers onboarding friction. The open questions are whether the 20% estimate holds up under independent review, whether the small exploited share stays small, and how much of the roughly $5.6 million in recovery addresses is actually returned to users versus held pending verification.