Web3Auth says funds moved from exposed wallets during its recovery operations are secure, with details on returning them expected in the coming days. Cointelegraph reported the update on November 14, 2026. For affected users, the immediate issue is getting rescued assets back into their control.
The assurance concerns assets moved into recovery wallets. It does not mean every asset stolen during the breach has been recovered, or that repayments have begun. Funds held for safekeeping and funds taken by an attacker have different recovery paths.
Rescue transfers complicated the loss picture
The incident produced an unusual problem for wallet owners. A reduced balance could reflect either theft or a protective transfer.
In its November 8 reporting, The Block described Web3Auth moving assets ahead of the attacker. Its review found roughly $5.6 million across 12 published recovery addresses at that time. Those balances were a snapshot of the recovery wallets when the outlet reviewed them.
The outlet also reported that eight addresses initially identified by Bitquery as attacker destinations appeared on Web3Auth's recovery list. That misclassification helps explain the confusion surrounding early theft estimates.
For an individual user, an outgoing transaction alone therefore gives an incomplete answer. The destination determines whether the transfer belongs to the rescue operation or the theft investigation. An empty wallet can still leave its owner with a recovery claim, although the money is unavailable for use while held elsewhere.
This differs from the software patching problem in earlier reporting on LNbits wallet thefts. Here, identifying who holds the transferred assets is part of establishing the user's position.
The attacker and the recovery operation had separate totals
Bitquery's updated investigation, published November 12, separates the two streams. It estimated that an attacker took at least $1.82 million between November 1 and November 12, while Web3Auth's rescue moved about $6 million into recovery addresses by November 7.
The theft estimate used token prices from November 7. It is neither a November 14 valuation nor a company-confirmed reimbursement figure.
Bitquery traced losses across 7,842 Cosmos wallets, 52 Ethereum wallets and 13 Hyperliquid accounts. It said approximately $1.01 million had already disappeared before the rescue began. Its investigation also found accounts reached by both the attacker and the recovery operation.
For users whose accounts were reached by both, a successful rescue transfer can preserve remaining assets after an earlier theft, leaving the stolen portion unresolved.
The $6 million figure should therefore stay attached to the rescue operation and its measurement date. Adding it to the theft estimate would mix protected assets with losses. Treating it as proof that everyone will receive their original balance would make the opposite error.
Wallet access has resumed, with restrictions remaining
Web3Auth's November 13 service and recovery update says existing users can again log in and access wallets through its Plug & Play and Single Factor Auth SDKs. Returning rescued assets remains a separate process coordinated with Keplr.
Developers face migration requirements. Web3Auth SDK versions 9 and older are deprecated, with upgrades directed to versions 10 or 11. Sapphire applications can enable new registrations after moving to the latest SDKs. Legacy applications must also migrate, with new registrations scheduled to resume by November 23.
For users, those milestones answer different questions. A working login restores access to the wallet interface. Return instructions determine the route back to assets held in recovery addresses. Developers should keep those statuses separate in customer communications so a restored sign-in is not mistaken for a completed financial recovery.
Web3Auth also warns against unsolicited recovery messages, requests for credentials and unfamiliar wallet connections. Its guidance is to follow official instructions and verify recovery addresses through official channels.
A private message promising immediate repayment is outside the announced process. Users waiting for funds have no reason to hand over a seed phrase to accelerate it.
Overview
Web3Auth's latest assurance concerns assets secured through protective transfers, with return details expected within days. Earlier reporting and Bitquery's investigation distinguish those assets from money taken by an attacker.
The recovery has two unfinished tasks: returning safeguarded assets and accounting for theft losses. Service restoration addresses access, while the promised instructions address distribution. As of November 14, the announced next step is publication of the return process.
