EL7.AI
CryptoMedium•8 November 2026•
2 min read

Keplr Reports Cover 44,041 Wallets, With Balances Estimated at $6.01 Million

Key Facts

1Bitquery estimated balances at aggregation addresses at $6.01 million at November 7 prices, without establishing that they were ultimately stolen losses.
2The count across seven chains was 44,041 wallets, while the number of Injective wallets remained an estimate.
3Web3Auth said the eight destinations identified by Bitquery included addresses used for transfers for protection.
4Bitquery found that balances in 86% of the monitored wallets across the seven chains had been withdrawn after Keplr’s warning.

Web3Auth announced a security issue on November 6 and temporarily suspended its embedded wallet service, according to its status page. The page recorded login service maintenance from November 6 at 18:30 UTC through November 7 at 18:30. Separately, Keplr said some wallets created through Google or Apple sign-in had transactions their owners did not make. Keplr disabled social login, while saying its initial assessment found no impact on wallets protected by a recovery phrase or on hardware wallets. The incident highlights risks affecting the social login pathway, while other wallets remained outside the scope of the reports described by Keplr.

Bitquery estimated balances at aggregation addresses at about $6.01 million, based on prices observed on November 7. That figure does not represent confirmed losses; in a later update, Web3Auth said it had identified recovery addresses and that the eight destinations listed by Bitquery had been used for transfers for protection. The balances at those addresses alone therefore do not prove that the funds were transferred to the attacker. Bitquery’s estimate excluded assets for which no market price was available. The transfer monitoring cited in the report also stopped at 15:38 UTC, while transfers on Cosmos Hub continued.

Bitquery counted at least 44,041 wallets across seven chains sharing the same aggregation key, according to data from November 6 and 7. Injective uses a different address format, so the report estimated that it added between 440 and 934 unique wallets. The report concluded that its estimate of wallets across the eight networks was not a confirmed count of affected people. The number of wallets also does not equal the number of customers, as each wallet may not represent a different person. The multi-chain monitoring reflects transfers spanning different networks, with varying degrees of certainty in the counts across chains.

Bitquery found that balances in about 86% of the wallets it monitored across the seven chains had been withdrawn after Keplr’s warning at 04:38 UTC on November 7. The timing of the withdrawals means movements continued after the warning was issued, according to the report. Keplr advised social login users not to send new funds to the affected account and to move any remaining liquid assets to a separate wallet. It also urged them to ignore offers to recover funds. MetaMask said it had temporarily suspended its Embedded Wallet service and that its initial investigation found no evidence that its users were affected.