Keplr has suspended Google and Apple wallet logins after a security breach involving Web3Auth exposed users’ private keys, with blockchain investigators tracing more than $6 million in transfers from over 44,000 wallets. Summary Keplr suspended Google and Apple logins after Web3Auth reported security problems involving social-login wallet accounts. Bitquery traced approximately $6 million in transfers across thousands of Cosmos wallets during the incident. Web3Auth identified several suspected attacker destinations as authorized wallets used to recover exposed cryptocurrency assets. Recovery addresses cover eleven Cosmos networks and eight EVM chains, according to Web3Auth’s November update. Keplr says recovery-phrase and hardware wallets were unaffected, while reimbursement details remain unavailable to users. In its November 7 security notice, Keplr Wallet confirmed receiving reports of unauthorized transactions involving accounts created through social logins. The company linked the incident to Web3Auth, a wallet authentication provider owned by Consensys, and began working with its team to investigate the affected accounts. We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since.Based on our initial assessment: if you created your Keplr wallet… https://t.co/EoXTC9ehpP— Keplr Wallet (@keplrwallet) November 7, 2026 The breach has left some users unable to access their wallets through the usual login process, while others have reported missing funds. Keplr co-founder Josh Lee estimated that roughly 20% of the platform’s Google and Apple login accounts could be affected, although he said only a fraction had been exploited. Keplr Wallet Hack Traced to Web3Auth Infrastructure Breach The security problem originated in infrastructure operated by Web3Auth, which allows users to create and access cryptocurrency wallets through existing online accounts without manually managing recovery phrases during onboarding. Lee explained that the incident was not caused by a compromise of Keplr’s own wallet code. Instead, the affected accounts relied on an external authentication service that subsequently experienced a security failure. “This was not a hack of Keplr’s code. The incident originated at Web3Auth, a provider Keplr uses,” Lee said. Web3Auth subsequently acknowledged an infrastructure problem affecting certain embedded wallets used by Keplr. The company temporarily suspended its embedded wallet service while investigating the breach and identifying accounts requiring protection. “After an initial investigation, we’ve found no evidence that MetaMask users are impacted,” the provider said. Although Web3Auth supports authentication services for third-party applications, the company has not published a complete list of other wallet providers exposed to the vulnerability. It has not publicly explained the technical entry point that allowed the affected private keys to become compromised. Blockchain Data Tracks $6M Across Thousands of Wallets Blockchain intelligence firm Bitquery traced approximately $6.01 million in assets across addresses associated with the November 6–7 incident. Its investigation identified 44,041 wallets across seven Cosmos networks, alongside 7,603 affected addresses on Injective. Because some wallets appeared across multiple networks, the researchers estimated roughly 44,700 distinct affected wallets after accounting for overlapping addresses. Cosmos Hub accounted for approximately $3.5 million of the recorded assets, with additional transfers involving Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective. The investigation found that approximately 86% of affected wallets on the seven linked networks experienced outgoing transfers after Keplr issued its initial warning. Researchers recorded transactions continuing on Cosmos Hub during their November 7 observation period. Bitquery identified transfers involving 1.96 million staked ATOM, with the transactions using staking-share tokenization to move positions without completing the usual 21-day unbonding period. However, Web3Auth’s November 8 update provided new information about the destination of some of those transfers. The company identified several addresses previously associated with suspected attacker activity as verified recovery wallets used to protect exposed assets. The addresses include a Cosmos Hub wallet associated with approximately $3.5 million and an Osmosis wallet linked to roughly $1.04 million in Bitquery’s investigation. Both match addresses Web3Auth identified as authorized recovery destinations. Consequently, the $6.01 million represents recorded transfers and cannot automatically be treated as confirmed theft losses. Web3Auth has not established how much cryptocurrency attackers ultimately obtained or how much its recovery teams have secured. Web3Auth Begins Whitehat Recovery for Exposed Accounts With some vulnerable accounts still holding cryptocurrency, Web3Auth and its partners have started whitehat recovery operations to protect funds before attackers can access them. In a November 8 update, Web3Auth confirmed that it had been transferring assets into secure recovery wallets with assistance from Keplr. The company published a list of verified addresses covering several Cosmos-based networks and Ethereum Virtual Machine-compatible chains. “We are aware that some of these transactions have been mistaken for attacker activity,” Web3Auth said in its recovery announcement. The published addresses cover Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric. Update on Keplr asset recovery:As part of our ongoing response to the security incident affecting certain Keplr wallets, we have been transferring assets into secure recovery wallets, with assistance from Keplr. 🧵— Web3Auth (@Web3Auth) November 8, 2026 For eight EVM-compatible chains, Web3Auth identified 0x413e4F4De7E5FF010913488F781E679e76f706dA as its recovery address. The company said the listed wallets were being used to secure affected assets and were not controlled by attackers. Web3Auth explained that recovery teams were using the same technical route exploited during the incident, causing some protective transactions to be mistaken for additional theft. Keplr subsequently warned that certain Google and Apple login wallets might display reduced or empty balances because of those protection measures. Staked and locked assets require more complicated recovery procedures, meaning the work could take longer. Lee previously said the majority of potentially exposed accounts might still be recoverable, although the company has not announced a final amount secured or returned to users. Keplr has not publicly established whether affected customers will receive reimbursement for confirmed losses. Meanwhile, Web3Auth said it would update its recovery address list as additional wallets are verified and warned users against impersonators offering fraudulent recovery assistance. Keplr Advises Social Login Users to Move Remaining Funds For customers who created wallets using recovery phrases or hardware devices, Keplr said the incident had not affected their accounts. Its latest guidance specifically concerns wallets created through Google or Apple authentication. The company advised social-login users against sending additional funds into potentially compromised accounts and instructed them to move any remaining liquid assets into recovery-phrase or hardware-wallet accounts. It is working with Web3Auth on a method for customers to establish whether their accounts were affected. Users were warned against unsolicited messages and links claiming to offer asset recovery. The incident follows other cryptocurrency security failures involving wallet credentials. In July, crypto.news covered an Injective software compromise involving a malicious developer package that exposed private keys and recovery phrases. An October Qubic wallet vulnerability similarly involved compromised wallet security, although investigators traced that incident to weaknesses in seed generation rather than third-party social authentication. Web3Auth said it would continue publishing verified recovery addresses as its investigation progresses. The company has not announced a timetable for returning all secured funds to affected users.
