The roughly $6.01 million tied to the Keplr wallet hack is a reported transfer estimate. In an update dated November 8, 2026, Web3Auth said some transactions mistaken for attacker activity were moves into recovery wallets, made with Keplr’s help.
What the $6.01 million figure counts
Bitquery’s analysis put the value of recorded transfers at about $6.01 million. That figure measures assets moving between addresses; Web3Auth said some of the movements were recovery operations. It is not a tally of assets taken by attackers.
The same analysis estimated roughly 44,700 distinct wallets after accounting for overlap across networks. That is a wallet estimate, separate from the dollar value of transfers.
Web3Auth’s November 8 update described moving assets into recovery wallets with Keplr’s assistance and said some of those transactions had been mistaken for attacker activity:
Which Keplr accounts were implicated
Keplr’s November 7, 2026 notice concerned reports of unauthorized transactions in some accounts created with Google or Apple sign-in. Keplr said it was investigating with Web3Auth and suspended those login methods. It also said accounts using a recovery phrase or hardware wallet were unaffected.
Keplr co-founder Josh Lee attributed the incident to Web3Auth’s infrastructure rather than Keplr’s wallet code. Lee’s statement described the provider as the source of the incident.
What Keplr advised social-login users to do
Keplr advised users with potentially affected social-login accounts not to add funds and to move any remaining liquid assets to an account using a recovery phrase or hardware wallet.
If a wallet’s private key has already leaked, changing the linked Google password is not a substitute for moving the remaining assets.
Learn Crypto presenter Peter makes that distinction in an explainer about the incident: changing a Google password does not secure a wallet key that has already been exposed.
