Web3Auth Moves $5.6M From Affected Keplr Wallets to Recovery Addresses

The significance here is less the dollar figure than the precedent: a wallet-infrastructure provider preemptively relocating user assets after a key-exposure bug, effectively racing attackers to funds it helped create. That shifts attention to the login-based key-derivation model shared across wallet providers, since the exposure traces to Google and Apple sign-in flows rather than Keplr's own interface. The open questions are whether the affected share cited by Keplr's co-founder proves accurate, whether any exploited balances remain unrecovered, and how recovery addresses are ultimately reconciled with rightful owners.