A flaw in Consensys-owned Web3Auth exposed keys of Keplr wallets with Google or Apple login. Web3Auth frontran the attacker and swept them first, into 12 addresses holding ~$5.6M.

The ~$6M pulled from 44,000+ wallets and first called theft is mostly that rescue: all 8 “thief” addresses are on the recovery list. The largest holds ~2.49M ATOM ($3.3M).

What the real attacker took is still undisclosed, and there is no compensation plan yet.

Seed-phrase and hardware wallets are not affected. Social-login users should move what’s left to a seed-phrase or hardware wallet.