Keplr disables Google and Apple logins after Web3Auth key exposure

What happened

Keplr has suspended Google and Apple sign-in for its wallet after a security failure at authentication provider Web3Auth left private keys for some social-login accounts exposed. In a November 7 notice, the Cosmos-focused wallet said it had received reports of transactions that account owners did not authorize on accounts created through those logins, and that it was investigating alongside Web3Auth's team. Accounts set up with a recovery phrase or a hardware device were not affected, the company said.

Web3Auth, an embedded-wallet provider owned by Consensys, confirmed an infrastructure problem affecting certain embedded wallets used by Keplr. It paused its embedded-wallet service on November 6 and placed its login service into maintenance while it reviewed the incident. The provider said it had found no evidence that MetaMask users were impacted, but it has not published a full list of other wallet providers that might be exposed, nor explained how the affected keys were compromised.

Keplr co-founder Josh Lee said the failure did not originate in Keplr's own wallet code. He estimated that roughly 20% of the platform's Google and Apple login accounts could be affected, while only a fraction of those had actually been exploited. Keplr disabled the two social-login routes during the investigation and told users of such accounts to shift any remaining liquid assets into wallets protected by a recovery phrase or hardware device, and to stop sending new funds to addresses that may be compromised.

Why it matters

Social-login wallets are built to reduce onboarding friction, letting people open an account through an existing online identity instead of recording a seed phrase. The trade-off is reliance on a third party that generates or accesses key material, which turns a single provider-side failure into a wallet-level problem. The exposure also spreads across chains: Cosmos networks derive addresses from one key under different prefixes, so a compromised key can reach balances on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective at once, as the on-chain record in this case shows.

What the data shows

Blockchain intelligence firm Bitquery traced approximately $6.01 million across two collection addresses linked to the November 6, 7 incident. Its researchers identified 44,041 wallets on seven Cosmos networks plus 7,603 affected addresses on Injective, arriving at roughly 44,700 distinct wallets once overlapping addresses were counted. Cosmos Hub accounted for about $3.5 million of the tracked assets. Bitquery also found that around 86% of affected wallets on the seven linked networks showed outgoing transfers after Keplr issued its first warning, and recorded movement of 1.96 million staked ATOM through staking-share tokenization, a route that avoids the standard 21-day unbonding wait. The largest individual loss it logged was close to $325,000, and unpriced tokens were excluded from the dollar total.

Background

The episode follows other recent failures involving wallet credentials. An October vulnerability affecting Qubic wallets also centred on compromised key security, though investigators attributed that case to weaknesses in seed generation rather than to third-party social authentication. Keplr and Web3Auth continue to coordinate account protection while the provider prepares material intended to separate authorized recovery transactions from attacker transfers.

What is still unclear

Those figures are not a settled loss tally. Web3Auth said its recovery teams were using the same technical path as the attacker to secure vulnerable wallets, meaning protective transfers can look identical to theft. On November 8 the provider published verified recovery destinations, and Keplr relayed the list, saying the named addresses were not malicious; several of them overlap with addresses Bitquery had earlier associated with the drain. Neither company has disclosed how much value was secured or produced a final reconciliation, and Keplr has not said whether customers with confirmed losses will be reimbursed. Keplr also cautioned that some accounts may display reduced or empty balances because assets were moved during mitigation, and that staked or locked holdings take longer to secure.

What to watch

What remains outstanding is a technical postmortem from Web3Auth, a reconciled loss figure and any statement on reimbursement. Until the two companies publish a breakdown, transfers seen on-chain should be read with care. Keplr's guidance to users stands: do not send funds to a social-login account, do not share recovery phrases, and do not act on direct messages or send assets to addresses described as rescue wallets.

Questions readers ask