Keplr has suspended Google and Apple social logins after users reported unauthorized transactions tied to a security flaw at Web3Auth, the Consensys-owned authentication provider behind the feature. The incident began unfolding on November 6, 2026, and prompted Web3Auth to move roughly $5.6 million in crypto out of vulnerable Keplr wallets in an effort to keep funds away from an attacker.
Web3Auth first disclosed the issue at approximately 21:13 UTC on November 6, saying a security issue was affecting services used by some third parties. It paused its embedded wallet service. Keplr published its own statement around 04:38 UTC on November 7, reporting unauthorized transactions on some accounts created with Google or Apple login. Chainapsis co-founder Josh Lee, whose company builds Keplr, said the incident was not a hack of Keplr's code but originated at Web3Auth. He estimated that about 20% of Keplr's Google and Apple login accounts may be affected, though only a fraction appeared fully exploited at that time. Recovery phrase and hardware wallet accounts were not affected.
On Saturday, Web3Auth said it had started emptying vulnerable wallets the attacker had not yet reached, using what it described as “the same path of the original attacker.” The company published 12 recovery addresses holding about $5.6 million in crypto. It said funds recovered through this process are safe and that it is working with Keplr on a recovery path for users. Web3Auth also acknowledged that some of these transactions had been mistaken for attacker activity.
Blockchain analytics firm Bitquery reported that a thief collected about $6 million from more than 44,000 Keplr wallets. All eight addresses Bitquery tied to the thief are on Web3Auth's recovery list. Most of the recovered funds were on Cosmos Hub, where one Web3Auth recovery address holds about 2.49 million ATOM worth roughly $3.3 million. Much of that ATOM had been staked, and the sweeps converted it into tokens that could be moved immediately instead of waiting out the network's 21-day withdrawal period.
Keplr has advised social-login users not to send new funds to affected accounts and to move any remaining funds to wallets secured by a recovery phrase or hardware device. The company also warned users to ignore direct messages or links offering recovery help, noting scammers often pose as support staff after wallet incidents. Neither Web3Auth nor Keplr has disclosed the total number of affected accounts, the full value of losses, the root cause, or a timeline for restoring logins.
Web3Auth said it found no evidence MetaMask users were affected. Consensys acquired Web3Auth in June 2025 and markets the service as MetaMask Embedded Wallets. The incident is the latest in a series of wallet security warnings, following a BTCPay Server hot wallet drain alert and CertiK's warning about the DarkSword iOS exploit targeting crypto wallets on unpatched iPhones.
