- Attackers drained at least $6 million from over 44,000 wallets across eight Cosmos ecosystem networks, according to blockchain analytics firm Bitquery.
- Web3Auth suspended its embedded wallet service to recover vulnerable assets, while Keplr advised users against depositing into compromised accounts.
- Major wallet providers MetaMask and Trust Wallet reported no affected users, and there is no confirmed correlation between the exploit and broader cryptocurrency market declines.
Multimillion-Dollar Exploit Targets Cosmos Ecosystem Wallets
A widespread security incident has resulted in the theft of at least $6 million across more than 44,000 cryptocurrency wallets, according to estimates released by blockchain analytics firm Bitquery. The breach targeted assets hosted on eight networks across the Cosmos ecosystem, spanning high-profile chains such as Cosmos Hub, Osmosis, Celestia, and Injective.
In the wake of the unauthorized withdrawals, infrastructure providers and wallet developers initiated rapid containment procedures. Keplr issued an urgent warning to its community, cautioning users against depositing funds into compromised accounts. Concurrently, authentication and key-management provider Web3Auth suspended its embedded wallet service as technical teams mobilized to recover vulnerable assets. The teams initiated investigations and began releasing rapid protocol patches more than 24 hours after discovering the vulnerability.
Third-Party Wallet Responses and Protocol Status
The incident spurred immediate assessments across the decentralized finance (DeFi) and self-custody wallet sectors. MetaMask confirmed that it has found no evidence of affected users among its base, noting that the situation remains under control. Similarly, Trust Wallet confirmed it was spared from the breach, with company representative Felix stating that Trust Wallet has been unaffected. The full extent of the impact on other third-party integrations and platforms utilizing affected infrastructure is yet to be confirmed.
Market analysts monitoring the situation observed that despite the scale of wallet compromises, the broader digital asset economy showed resilience. There is no proven link connecting the Web3Auth exploit to wider downturns across major cryptocurrencies, including Bitcoin and Ethereum.
Broader Wave of High-Profile Security Incidents
The compromise adds to a troubling sequence of large-scale security failures across the cryptocurrency industry. High-profile centralized platforms and cross-chain solutions have faced severe disruptions in recent months. On October 29, Binance reportedly suffered a massive security breach involving approximately $6.3 billion, following a September exploit against Bitget that resulted in an estimated $387.5 million in losses. Earlier in 2026, liquid restaking platform KelpDAO lost around $290 million following an exploit targeting cross-chain infrastructure.
Why This Matters
The compromise of embedded wallet infrastructures, DeFi protocols, and smart contracts represents an ongoing vulnerability for the digital asset landscape. These incidents exert direct downward pressure on market sentiment, inflict immediate losses on retail and institutional investors, and undermine general confidence in decentralized architecture. Projects dependent on embedded wallet technology and Cosmos-related assets face heightened scrutiny, as repeated security failures threaten to degrade ecosystem adoption, user trust, and long-term standing in the competitive Web3 marketplace.
Frequently Asked Questions
Which Cosmos networks were affected by the exploit?
According to Bitquery, the exploit targeted wallets spanning eight Cosmos ecosystem networks, specifically identifying Cosmos Hub, Osmosis, Celestia, and Injective among the affected chains.
Were major self-custody wallets like MetaMask or Trust Wallet compromised?
MetaMask reported no evidence that its users were impacted by the incident, and Trust Wallet representative Felix stated that the application remained entirely unaffected.
What steps did Web3Auth take following the breach?
Web3Auth suspended its embedded wallet service to contain the exploit, actively deploying resources toward recovering vulnerable assets and issuing protocol patches within 24 hours of the exploit’s discovery.
