Keplr halts Google, Apple logins as $6M wallet drain hits Cosmos

Keplr has suspended Google and Apple wallet logins after a security breach involving Web3Auth exposed users’ private keys, with blockchain investigators tracing more than $6 million in transfers from over 44,000 wallets.

In its November 7 security notice, Keplr Wallet confirmed receiving reports of unauthorized transactions involving accounts created through social logins. The company linked the incident to Web3Auth, a wallet authentication provider owned by Consensys, and began working with its team to investigate the affected accounts.

We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since.

Based on our initial assessment: if you created your Keplr wallet… https://t.co/EoXTC9ehpP

— Keplr Wallet (@keplrwallet) November 7, 2026

The breach has left some users unable to access their wallets through the usual login process, while others have reported missing funds. Keplr co-founder Josh Lee estimated that roughly 20% of the platform’s Google and Apple login accounts could be affected, although he said only a fraction had been exploited.

Keplr Wallet Hack Traced to Web3Auth Infrastructure Breach

The security problem originated in infrastructure operated by Web3Auth, which allows users to create and access cryptocurrency wallets through existing online accounts without manually managing recovery phrases during onboarding.

Lee explained that the incident was not caused by a compromise of Keplr’s own wallet code. Instead, the affected accounts relied on an external authentication service that subsequently experienced a security failure.

“This was not a hack of Keplr’s code. The incident originated at Web3Auth, a provider Keplr uses,” Lee said.

Web3Auth subsequently acknowledged an infrastructure problem affecting certain embedded wallets used by Keplr. The company temporarily suspended its embedded wallet service while investigating the breach and identifying accounts requiring protection.

“After an initial investigation, we’ve found no evidence that MetaMask users are impacted,” the provider said.

Although Web3Auth supports authentication services for third-party applications, the company has not published a complete list of other wallet providers exposed to the vulnerability. It has not publicly explained the technical entry point that allowed the affected private keys to become compromised.

Blockchain Data Tracks $6M Across Thousands of Wallets

Blockchain intelligence firm Bitquery traced approximately $6.01 million in assets across two collection addresses associated with the November 6–7 incident.

Its investigation identified 44,041 wallets across seven Cosmos networks, alongside 7,603 affected addresses on Injective. Because some wallets appeared across multiple networks, the researchers estimated roughly 44,700 distinct affected wallets after accounting for overlapping addresses.

Cosmos Hub accounted for approximately $3.5 million of the recorded assets, with additional transfers involving Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective.

The investigation found that approximately 86% of affected wallets on the seven linked networks experienced outgoing transfers after Keplr issued its initial warning. Researchers recorded transactions continuing on Cosmos Hub during their November 7 observation period.

Bitquery identified transfers involving 1.96 million staked ATOM, with the transactions using staking-share tokenization to move positions without completing the usual 21-day unbonding period.

However, Web3Auth subsequently disclosed that authorized recovery teams were moving assets through similar transaction paths. 

Consequently, the recorded transfers cannot all be treated as confirmed attacker-controlled losses without distinguishing recovery addresses from malicious destinations.

Web3Auth Begins Whitehat Recovery for Exposed Accounts

With some vulnerable accounts still holding cryptocurrency, Web3Auth and its partners have started whitehat recovery operations to protect funds before attackers can access them.

The company said recovery teams were using the same technical route exploited during the incident, which had caused some protective transactions to be mistaken for additional theft.

Keplr subsequently warned that certain Google and Apple login wallets might display reduced or empty balances because of those protection measures. Staked and locked assets require more complicated recovery procedures, meaning the work could take longer.

Lee had previously said the majority of potentially exposed accounts might still be recoverable, although the company has not announced a final amount secured or returned to users.

Keplr has not publicly established whether affected customers will receive reimbursement for confirmed losses.

Keplr Advises Social Login Users to Move Remaining Funds

For customers who created wallets using recovery phrases or hardware devices, Keplr said the incident had not affected their accounts. Its latest guidance specifically concerns wallets created through Google or Apple authentication.

The company advised social-login users against sending additional funds into potentially compromised accounts and instructed them to move any remaining liquid assets into recovery-phrase or hardware-wallet accounts.

It is working with Web3Auth on a method for customers to establish whether their accounts were affected. Users were warned against unsolicited messages and links claiming to offer asset recovery.

The incident follows other cryptocurrency security failures involving wallet credentials. In July, crypto.news covered an Injective software compromise involving a malicious developer package that exposed private keys and recovery phrases.

An October Qubic wallet vulnerability similarly involved compromised wallet security, although investigators traced that incident to weaknesses in seed generation rather than third-party social authentication.

Web3Auth and Keplr continue coordinating account protection and recovery, while the provider prepares information to distinguish authorized recovery transactions from transfers associated with the attacker.