Keplr Wallet has disabled Google and Apple login options after a security incident at authentication provider Web3Auth exposed private keys for some social-login accounts, leading to widespread unauthorized transfers across Cosmos networks. Blockchain data tracked approximately $6.01 million leaving more than 44,000 wallets, though a substantial portion of those movements has been identified as authorized recovery operations rather than confirmed theft.

Incident Origin and Immediate Response

Reports of unauthorized transactions on Keplr accounts created through Google or Apple authentication surfaced around November 6 and 7. Keplr confirmed the activity and suspended both social-login methods while coordinating with Web3Auth, a Consensys-owned service that handles embedded wallet authentication for the platform.

Keplr co-founder Josh Lee stated that the problem did not stem from Keplr’s own code. The exposure originated in Web3Auth infrastructure used for social logins. Lee estimated that roughly 20 percent of the platform’s Google- and Apple-login accounts could have been affected, though only a fraction of those were actually exploited.

Web3Auth acknowledged an infrastructure issue affecting certain embedded wallets, temporarily suspended its embedded wallet service, and began investigating. The company reported no evidence that MetaMask users were impacted. Accounts created with recovery phrases or hardware wallets were unaffected, according to Keplr.

Scale of On-Chain Activity

Blockchain intelligence firm Bitquery examined transfers between November 6 and 7 and identified approximately $6.01 million flowing to collection addresses. The analysis covered 44,041 wallets across seven Cosmos networks and 7,603 addresses on Injective, equating to roughly 44,700 distinct affected wallets after accounting for overlaps.

Cosmos Hub accounted for about $3.5 million of the recorded value. Osmosis saw roughly $1.04 million, with additional activity on Celestia, Akash, Noble, Babylon, dYdX, and Injective. Investigators also documented the movement of approximately 1.96 million staked ATOM through liquid-staking share tokens, allowing positions to transfer without the standard 21-day unbonding period.

About 86 percent of affected wallets on the linked networks recorded outgoing transfers after Keplr issued its initial warning. Median losses were small, though individual transfers reached as high as several hundred thousand dollars.

Recovery Operations Complicate Loss Estimates

Web3Auth and partners launched white-hat recovery efforts, transferring assets from still-vulnerable accounts into secure addresses before further unauthorized activity could occur. The recovery teams used the same technical access path that had been exploited, causing some protective transfers to appear similar to malicious drains on-chain.

Web3Auth published a list of verified recovery addresses. On-chain data showed those addresses holding about $5.6 million. Keplr confirmed the listed destinations as authorized. Destinations matching the recovery wallets accounted for substantial portions of the Cosmos Hub and Osmosis totals previously flagged in the $6.01 million figure.

As a result, the overall transfer total cannot be treated as a verified theft amount. Web3Auth referred to an “original attacker,” indicating that some funds left affected wallets before recovery teams acted, but it has not published a confirmed figure for irrecoverable losses.

Keplr cautioned that some users might see reduced or empty balances in social-login wallets because assets had been moved for safekeeping. Staked and locked positions require more complex handling and may take longer to process.

Guidance for Users

Keplr advised holders of Google- or Apple-login wallets not to deposit additional funds into those accounts. Remaining liquid assets should be moved to newly created wallets secured by recovery phrases or hardware devices. Users were told to disregard unsolicited messages or links offering recovery assistance and to rely only on official communications from Keplr and Web3Auth.

The companies are developing a method for customers to check whether their accounts were among those affected. Web3Auth has said it will continue updating its published recovery address list as verification proceeds. No final reimbursement plan for any confirmed losses has been announced.

The episode illustrates the trade-offs of social-login convenience in cryptocurrency wallets. While the feature lowers barriers for new users, it introduces reliance on third-party key infrastructure that can become a single point of failure when compromised.