Some Keplr crypto wallet users who signed up with a Google or Apple account have had funds taken by an attacker after a security flaw at Web3Auth, the company that runs Keplr’s social login, exposed the private keys behind those wallets. Web3Auth then used the attacker’s own route to empty other at-risk wallets into what it calls secure recovery wallets, and Keplr has paused Google and Apple sign-in while the investigation continues.
Keplr is a popular wallet for the Cosmos family of blockchains. Web3Auth, which Consensys acquired in 2025 and now offers as MetaMask Embedded Wallets, lets apps create a crypto wallet through a familiar Google or Apple login instead of a written recovery phrase.
How the incident unfolded
Web3Auth first disclosed a problem on November 6, saying it was aware of “a security issue affecting Web3Auth’s services used by some third parties.” It temporarily paused its embedded wallet service and said an initial investigation found no evidence that MetaMask users were affected. The same notice was posted to the MetaMask Builder forum.
A few hours later, Keplr said it had received reports of unauthorized transactions on some accounts created with Google or Apple login and had flagged the issue to Web3Auth.
We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since.
Based on our initial assessment: if you created your Keplr wallet… https://t.co/EoXTC9ehpP
– Keplr Wallet (@keplrwallet) November 7, 2026
On November 7, Web3Auth confirmed it had “identified a security issue in Web3Auth infrastructure affecting certain embedded wallets used by Keplr.” Keplr went further in a follow-up post, describing “Web3Auth’s infrastructure vulnerability leading to private key breach” for some users who signed in with Google or Apple. A private key approves every transaction from a wallet, so anyone holding it can move the funds.
Keplr co-founder Josh Lee wrote on X that “this was not a hack of Keplr’s code” and that the incident originated at Web3Auth. His early estimate was that about 20% of Keplr accounts created with Google or Apple login were affected, and that “only a fraction of that 20% has actually been exploited.”
Web3Auth swept at-risk wallets using the attacker’s path
Web3Auth said that, with its partners, it began “whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker.” In other words, it moved funds out of exposed wallets before the attacker could reach them.
As part of the security response relating to the incident affecting certain Keplr wallets, we, in connection with our partners, began whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker.
– Web3Auth (@Web3Auth) November 7, 2026
The company said funds recovered this way are safe and that it is working with Keplr on “a path to recovery for users.” Keplr warned that some Google and Apple login accounts “may already show a reduced or empty balance as a result of these mitigation efforts,” and that staked and locked assets take longer to secure.
Because the rescue sweeps looked the same on-chain as theft, some were reported as attacker activity. On November 8, Web3Auth published a list of verified recovery addresses, which Keplr reposted. The list covers Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, plus one EVM address used across eight Ethereum-style chains.
What the blockchain data shows
Blockchain data firm Bitquery, which first reported the sweeps as theft and later corrected its analysis, counted at least $6.01 million moving from at least 44,041 Keplr social login wallets on seven Cosmos chains and 7,603 on Injective into addresses that are now on Web3Auth’s recovery list. Its other findings include:
- The first sweeps began at 20:52 UTC on November 6, about 21 minutes before Web3Auth’s first public notice.
- About 86% of the wallets were swept after Keplr warned users.
- About 1.96 million staked ATOM left the wallets as staking share tokens, skipping the usual 21-day unbonding wait.
- The recovery wallets had not sent any funds out as of November 8.
Bitquery said it cannot independently confirm who controls the recovery wallets and that its count cannot see wallets the original attacker emptied elsewhere.
What is still unknown
Neither Keplr nor Web3Auth has said how the flaw worked, when the attacker first used it, how many wallets the attacker drained or how much was stolen. Neither company has named an attacker address. Web3 security firm GoPlus said in an alert that at least about $1 million was stolen, but it did not explain how it reached that figure, and BreachNews could not verify it.
The outage is also hitting other apps built on Web3Auth. As of November 9, Web3Auth’s status page listed its Login Service under maintenance, and developers on the MetaMask Builder forum said their own users still could not log in.
Attacks that reach crypto users through a trusted third party have been a running theme this fall. BreachNews previously covered the Polymarket drain tied to a compromised DebugBear script, the Keystone hardware wallet authentication key theft and the BTCPay Server hot wallet sweeps.
What Keplr users should do
Keplr says wallets created with a recovery phrase or a hardware wallet are not affected. If you created a Keplr account with Google or Apple login, the company advises you to:
- Stop sending new funds to that account.
- Not re-import or recreate the account anywhere else.
- Move any remaining liquid assets to a recovery phrase or hardware wallet account.
- Trust updates only from the official Keplr and Web3Auth accounts, and ignore direct messages or links offering “recovery.”
Keplr said it is working with Web3Auth on a way for users to check whether their accounts were affected. Scammers often target victims of crypto incidents with fake recovery services, so treat any unsolicited offer to return funds as a likely fraud.
