Web3Auth Exploit Doesn't Affect Trust Wallet: Products That Might be Affected

Web3Auth is the infrastructure many wallets use to let people skip seed phrases and sign in with a Google or Apple account instead, splitting the resulting key through MPC so no single party is supposed to hold it. Keplr, a leading Cosmos wallet, built its social-login option on this service. The same convenience model underpins rivals like Particle Network and Magic, which is why a single vendor's incident can ripple across wallets that otherwise look unrelated, draining funds across eight Cosmos networks by initial counts.

Keplr users who created wallets via Google or Apple now need to check whether their addresses were ever flagged, since Web3Auth says some of the 'attacker' wallets Bitquery identified are actually its own recovery addresses holding user funds, not stolen ones. Trust Wallet customers can stand down entirely, as the company confirmed no exposure. Anyone using a lesser-known wallet built on Web3Auth, however, still has to wait for that product's own confirmation before assuming safety.

Social login was sold as the fix for crypto's onboarding problem, letting new users skip seed phrases entirely. This episode shows the cost: when Web3Auth holds recovery wallets on users' behalf, it is also the party that decides, after the fact, whether a flagged address is a thief or itself. That is a custodial relationship dressed as a convenience feature, and the gap between Bitquery's $6.01 million theft estimate and Web3Auth's rebuttal shows how little outside observers can verify on their own.

Keplr's confirmation that a six-account Cosmos Hub batch tokenizing 2,265.59 staked ATOM led back to Web3Auth recovery addresses is the first concrete reconciliation point, and more such matches would shrink the real loss figure well below initial estimates. Watch whether Web3Auth publishes a full account-by-account breakdown of the flagged wallets, since that document, not further dueling press statements, will settle how much of the $6 million was ever actually stolen.