Keplr wallets made with Google or Apple login were drained after a Web3Auth breach: what happened and what to do

Signing in to a crypto wallet with your Google or Apple account is meant to make things easy: no list of secret words to write down. This weekend that convenience went wrong. Keplr, one of the most-used wallets for the Cosmos family of blockchains, says some accounts created that way were emptied after a security flaw at the outside company that runs the login. Wallets secured by a seed phrase or a hardware device weren't touched, it says.

What happened

Here is the timeline from the two companies' own posts on X:

• November 6, about 4:13 PM ET: Web3Auth, which provides the Google and Apple login used by Keplr and other apps, posted that a security problem was hitting services some outside apps rely on. It paused its embedded wallet service and said it had seen no sign so far that MetaMask users were hit. Its status page put its Login Service into maintenance "due to a security incident."
• November 6, about 11:38 PM ET: Keplr said it had received reports of unauthorized transactions on some accounts created with Google or Apple login. It paused those login options.
• November 7: Keplr co-founder Josh Lee said Keplr's own code wasn't hacked and that the incident started at Web3Auth. Later that day Web3Auth confirmed the problem was in its own systems and hit some of the embedded wallets Keplr uses, and Keplr described it as a vulnerability that led to a private key breach.
• November 8: Web3Auth, and then Keplr, posted a list of addresses on 11 Cosmos networks plus one EVM address (which Web3Auth says covers eight chains) that Web3Auth says it verified as part of the recovery effort, not the attacker.

Web3Auth has been part of Consensys, the company behind MetaMask, since June 2025. According to Keplr's help pages, Web3Auth generates the key for Google-login accounts, and those accounts receive a single private key instead of a 12- or 24-word seed phrase.

How big is it?

The companies haven't published a final count. Josh Lee's early estimate was that about 20% of Keplr's Google and Apple login accounts were affected, and that only a fraction of those appeared to have actually been exploited.

Blockchain data firm Bitquery, which analyzed the on-chain transfers, counted at least 44,041 wallets across seven Cosmos networks, plus 7,603 on Injective (mostly the same owners, about 44,700 in total), that sent funds to collector addresses holding about $6.01 million. Most of it sat on the Cosmos Hub. It also found that staked ATOM left the wallets without the usual 21-day unbonding wait, because the stakes were converted into transferable share tokens first. These are Bitquery's estimates, not company figures.

There is an important twist. Web3Auth says it and its partners started "whitehat" recovery transfers from wallets that were vulnerable but not yet hit, using the same path as the attacker, to move funds out of reach. It says some of those transfers were mistaken for attacker activity, and that funds recovered this way are safe. On November 8 it published a list of what it calls verified recovery addresses, "not attacker-controlled wallets." All eight addresses Bitquery had labelled as collectors, across eight networks including the Cosmos Hub and Injective, are on that list.

The two accounts haven't been squared yet. Bitquery dates the first transfers into those addresses to 20:52 UTC (3:52 PM ET) on November 6, about 20 minutes before Web3Auth's first public notice, and it said it thought a rescue was unlikely but would correct the record if either company said otherwise. Its report hadn't been updated as of the morning of November 8. If Web3Auth's list is right, the money Bitquery counted is sitting in recovery wallets rather than with a thief, but neither company has said how much the attacker took for itself. We'll update this post when they publish a breakdown.

If you use Keplr: what to do now

• Check how you created your account. If it came from a seed phrase or a hardware device, Keplr says you're in the clear.
• If you used Google or Apple login: Keplr says stop depositing to that account, don't re-import or recreate it in any other app, and shift whatever liquid crypto is left into a seed-phrase or hardware-device account. Keplr says rescuing staked and locked assets is more complex and is taking longer.
• Don't panic over an empty balance. Keplr says the rescue effort may mean some social-login accounts already look lower, or even at zero. Compare any transfer with the recovery addresses posted by Keplr and Web3Auth themselves.
• Ignore "recovery" offers. Keplr says to trust updates only from its own account or Web3Auth's, and to ignore DMs or links offering recovery. Anyone who messages you promising to get your crypto back is almost certainly running a recovery scam.

Not sure about a message? Paste it into our free Scam Check.

The bigger lesson about "easy" wallets

A self-custody wallet is only as safe as the place its key comes from. When you keep a seed phrase or use a hardware device, the key stays with you. With a social login, an outside service helps create or rebuild it behind the scenes. That removes the risk of losing a piece of paper, but adds a company you have to trust. Keplr's co-founder noted that the people who sign up this way are probably newcomers.

That doesn't mean social logins are always a bad idea. They can be fine for small amounts while you learn. But for savings you can't afford to lose, a recovery phrase you've written down and stored safely, or a hardware wallet, keeps the key in your hands. Our seed phrase guide and wallet basics explain how each type works.

What we still don't know

• How the keys were exposed. Neither company has explained the root cause.
• Exactly how many accounts lost funds to the attacker, and how much of the moved money was rescued.
• Whether other apps that use Web3Auth's login were affected. Web3Auth hasn't published a list.
• Whether users will be repaid, and when.

The takeaway

Keplr says some Google- and Apple-login wallets were drained through a flaw at its login provider Web3Auth, while seed-phrase and hardware-device wallets stayed safe. If you used social login, follow Keplr's steps and trust only its official posts. This is education, not financial advice, and it reflects company statements and reports as of the morning of November 8, 2026.

Published November 8, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio