Consensys-owned Web3Auth, the key provider behind Keplr's Google and Apple logins, used the same flaw that exposed users' private keys to pull their funds into safe addresses before attackers could drain them.

The 12 recovery wallets used in the whitehat rescue currently hold about $5.6M.

Keplr paused Google and Apple sign-ins on November 6 after users reported unauthorized transactions. Up to 20% of social-login accounts may be exposed, while wallets created with a recovery phrase or a hardware device are not affected.

Web3Auth's communications also referred to an "original attacker", suggesting some funds were already stolen. On-chain investigators traced more than $6M in outflows linked to the incident.