Keplr Wallet halts Google and Apple login after Web3Auth flaw drains accounts

If you set up your Keplr Wallet through a Google or Apple account, do not deposit any new funds into it for now. Keplr suspended Google and Apple login on November 6, 2026, after users reported unauthorised transactions. According to the companies involved, the cause lies with the service provider Web3Auth, which generates the keys for these accounts on Keplr's behalf. Accounts with their own seed phrase and accounts linked to a hardware wallet are not affected, based on Keplr's preliminary review.

Keplr is a multi-chain wallet with its main focus on the Cosmos ecosystem. It is developed by the company Chainapsis. Many investors use it to hold and stake coins such as ATOM, OSMO or INJ. The incident therefore hits precisely the group that wanted the most convenient possible wallet setup: no slip of paper with 12 or 24 words, just a click on "Sign in with Google".

Keplr Wallet exploit: what is known about the unauthorised transactions

According to a Crypto Adventure report dated November 7, 2026, users reported outflows from wallets they had created with a Google or Apple login. Keplr then switched off sign-in through both services and opened an investigation together with Web3Auth. Josh Lee, co-founder of Chainapsis, estimated according to the same report that around 20 percent of social login accounts could be affected, while only some of them were actually exploited.

No confirmed loss figure exists so far. Neither Keplr nor Web3Auth has put a number on the affected accounts or the value of the drained coins. Community estimates circulating on social media vary widely and have not been confirmed by either company. The only reliable distinction so far is based on how an account was created.

Crypto Adventure also reports that Lee stressed the flaw does not sit in the code of the Keplr app itself. That changes little for victims, but it explains why Keplr cannot handle the recovery on its own.

Web3Auth pauses embedded wallets: the response on November 6

On November 6, Web3Auth confirmed a security incident affecting services used by some third-party providers. The company temporarily suspended its service for so-called embedded wallets. An embedded wallet is one that an app builds directly into its own product, so the user needs neither separate wallet software nor a recovery phrase of their own.

After an initial investigation, Web3Auth says it found no indication that MetaMask users are affected. There is a reason for that statement: according to Crypto Adventure, Web3Auth has belonged to Consensys, the developer of MetaMask, since 2025. Anyone who uses MetaMask the classic way with their own seed phrase is, on everything known so far, untouched by this incident.

Social login with Google and Apple: how Keplr creates the key without a seed phrase

At its core, a wallet is a private key. Whoever knows it controls the coins. With a classic wallet, the user's device generates this key and displays it as a seed phrase, a sequence of 12 or 24 words from which the key can be derived again at any time.

Social login works differently. According to the Keplr documentation cited in a KuCoin News report from November 7, Web3Auth generates the private key for accounts with Google login instead of a seed phrase. Web3Auth uses distributed key generation: the key is split into shares that are stored in different places and only work together again at login. The user sees none of this and simply signs in with a Google or Apple account.

That convenience comes at a price. The security of the account no longer depends on the user alone but also on the provider's infrastructure. If a component fails there or comes under attack, the user can do nothing about it, however carefully the Google account itself is protected.

Cause according to Web3Auth: an infrastructure flaw exposed private keys

On November 7, according to KuCoin News, Web3Auth named a cause for the first time: a vulnerability in its own infrastructure that led to private keys being leaked. Some users who had signed in through Google or Apple were affected. Neither company has yet disclosed exactly how the attackers exploited the flaw. Web3Auth said it would share further details once the recovery of funds is complete.

The known part is enough to put the incident in context. Anyone holding a wallet's private key needs no password and no confirmation from the owner. Such a drain cannot be reversed by a chargeback either, because transactions on a blockchain are final.

Protective transfers at Keplr: why a balance can be empty without an attacker

One detail is causing confusion among those affected. According to KuCoin News, Web3Auth and its partners have started moving funds out of wallets that have not yet been attacked but are at risk. By their own account, they used the same route as the original attacker. Keplr therefore warned that some Google or Apple login accounts may show a reduced or empty balance after this rescue.

An empty account does not automatically mean the coins have been stolen. According to the report, Web3Auth is compiling a verified list of the addresses to which rescued funds were sent. This should allow users and the teams of the affected blockchains to tell legitimate rescue transfers apart from the attacker's transactions. Web3Auth said nobody should rush to attribute an unknown destination address to the attacker.

Keplr also says it is working with Web3Auth on a way for users to check for themselves whether their account is affected. No date has been given for it yet.

Cosmos, Injective and Osmosis: the blockchains where outflows were spotted

According to Crypto Adventure, community investigators traced suspicious movements involving Injective (INJ), Osmosis (OSMO) and Cosmos Hub (ATOM). That fits the profile of a wallet used mainly in the Cosmos ecosystem. Neither Keplr nor Web3Auth has published an official list of affected networks.

If you hold Cosmos (ATOM) or Injective (INJ), what matters is where your coins sit. Coins held on an exchange or in a wallet with your own seed phrase are not caught up in this incident. To see which wallet apps work entirely without a third-party key service, see our software wallet comparison.

How to protect yourself after the Web3Auth attack on social login wallets

What happened: On November 6, 2026, Keplr users reported unauthorised transactions from wallets created with a Google or Apple login via Web3Auth. Web3Auth attributes the incident to a flaw in its infrastructure that exposed private keys. As of November 7, there is no confirmed loss figure.

Are you affected? You may be affected if you created a Keplr account through "Sign in with Google" or "Sign in with Apple". If you created your Keplr Wallet with a seed phrase or connected it to a hardware wallet, you are not affected according to Keplr's preliminary review. So far, the only way to tell whether an individual social login account was attacked is to look at the balance and the transactions in a block explorer.

1. No deposits: Do not send new funds or staking rewards to a Keplr account with Google or Apple login until Keplr re-enables the service.
2. Move the remaining balance: Create a new account with your own seed phrase in Keplr or another wallet and move freely available coins there, as Keplr advises those affected.
3. No re-import: Do not import the social login account into another app and do not recreate it while the investigation is ongoing.
4. Ignore fake rescuers: Do not reply to any direct message offering to recover your coins, and never enter a key or seed phrase anywhere.
5. Wait for the address list: If your account shows an empty balance, compare the destination address with the rescue list Web3Auth has announced before you assume theft.

Our guide how to store crypto safely explains the basics of secure storage, and the hardware wallet comparison sets the right devices side by side.

Seed phrase or hardware wallet: these Keplr accounts remain untouched

With a seed phrase wallet, the private key is created on the user's device and never leaves it. No service provider holds any part of it. A hardware wallet goes one step further: it is a small dedicated device that stores the key and signs every transaction itself, so the key never even reaches the computer or smartphone.

That separation explains why the Web3Auth incident only affects social login accounts. The flip side: lose the seed phrase and you lose access for good, and nobody can help. A copy on paper or a stamped metal plate kept in a safe place therefore belongs with every wallet that has its own key.

Staking on Keplr: locked coins slow down the rescue

Many Keplr users stake their coins, meaning they delegate them to a validator to earn rewards. In the Cosmos ecosystem, staked coins cannot be moved immediately; unbonding them involves a waiting period. According to KuCoin News, Keplr pointed out that staked and locked balances make the rescue more complicated and slower.

For those affected, this means freely available coins can be moved to a secure account as Keplr advises, but locked coins cannot simply follow. If you have staked holdings on a social login account, follow Keplr's announcements on its official X account, which the wallet says it uses to share verified updates.

Phishing after the Keplr incident: fake helpers in direct messages

Every major incident brings out scammers posing as support staff or recovery services. Keplr explicitly warned against unsolicited recovery offers, fake support messages and links promising to retrieve stolen coins. No reputable provider will ever ask for a seed phrase or a private key.

A safe route always goes through the provider's official website or official account, which you open yourself, never through a link someone sends you. A genuine rescue offer from Keplr or Web3Auth would be announced publicly, not distributed by private message.

Keplr after Web3Auth: new money only into accounts with your own seed phrase

As of November 7, no refund and no date for the return of social login have been announced. Until Keplr delivers a checking tool and Web3Auth publishes the address list, the safe course is to move to an account with your own key. Three steps get you there:

1. Choose a device: For larger holdings, a hardware wallet offers the strongest protection; models with Cosmos support are listed in the hardware wallet comparison.
2. Wallet app with seed phrase: For smaller amounts, a software wallet where you generate the recovery phrase yourself is enough; providers are listed in the software wallet comparison.
3. Keep trading separate: Coins you want to trade belong on an exchange licensed under the EU's MiCA regulation; the comparison of regulated crypto exchanges gives an overview.

(As of November 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)