Keplr Pauses Google and Apple Logins After Web3Auth Flaw Exposes Wallet Keys, $5.6 Million Swept to Recovery Wallets

Keplr, one of the most widely used wallets in the Cosmos ecosystem, has switched off Google and Apple sign-in after a flaw at its login provider, Web3Auth, exposed the private keys of some users who created their wallets that way.

Over the weekend, the incident turned into a confusing race on-chain. An attacker drained some accounts, while Web3Auth says it used the very same route to sweep funds out of exposed wallets before the attacker could reach them.

By Sunday, The Block counted about $5.6 million sitting in 12 recovery addresses that Web3Auth published. How much was actually stolen is still unknown.

What happened

Web3Auth, the Consensys-owned service that powers social logins for Keplr, first flagged "a security issue affecting Web3Auth's services used by some third parties" on X at 21:13 UTC on November 6, according to a timeline compiled by Coindaro. It paused its embedded wallet service and said it had found "no evidence that MetaMask users are impacted."

On Saturday, November 7, Keplr said it had received reports of unauthorized transactions from accounts created with Google or Apple login, and paused both sign-in options.

Later that day, Keplr named the cause as "Web3Auth's infrastructure vulnerability leading to private key breach" for some of those users. Wallets created with a recovery phrase or a hardware device were "NOT affected," the company said.

"This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses," Keplr co-founder Josh Lee wrote on X, as quoted by The Block. He estimated that about 20% of Keplr's Google and Apple login accounts were affected.

A $6 million drain, or a rescue?

The first numbers came from blockchain analytics firm Bitquery. According to crypto.news, it traced about $6.01 million in transfers out of 44,041 wallets across seven Cosmos networks, plus 7,603 addresses on Injective, or roughly 44,700 distinct wallets once overlaps are removed.

Cosmos Hub made up about $3.5 million of that. Bitquery also saw 1.96 million staked ATOM moved using staking-share tokenization, a trick that skips the network's usual 21-day unbonding period.

Then the picture shifted. Web3Auth said it and its partners had begun "whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker."

"We are aware that some of these transactions have been mistaken for attacker activity," Web3Auth said early Sunday as it published a list of verified recovery addresses. The Block found that all eight addresses Bitquery had tied to the thief appear on that list.

Crypto Briefing reported that Web3Auth is disputing the $6.01 million theft figure outright, arguing the funds went to wallets it controls rather than to an attacker.

Where the money sits now

The Block's on-chain review put about $5.6 million in Web3Auth's 12 recovery addresses as of Sunday. Most of it is on Cosmos Hub, where one address holds roughly 2.49 million ATOM, worth about $3.3 million.

The recovery list covers 11 Cosmos-based networks, including Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, plus eight EVM-compatible chains, crypto.news reported.

"Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users," Web3Auth said.

The catch is in the phrase "original attacker." It confirms that someone exploited the flaw before the rescue started. Neither company has said how many wallets were drained or how much was lost for good.

Lee struck a hopeful note on Saturday. "It appears only a fraction of that 20% has actually been exploited, and the remaining accounts may be recoverable," he wrote.

Why social-login wallets were exposed

Social login is meant to make self-custody painless. Instead of writing down a seed phrase, you sign in with a Gmail or Apple ID, and a provider handles key management in the background.

In Web3Auth's standard design, as Coindaro explains from the company's documentation, the private key is split into pieces with Shamir's Secret Sharing. One piece sits on the device and another is released by Web3Auth's nodes after a valid Google or Apple login.

That setup means no single party should be able to move funds alone. But it also means one flaw in the shared service can reach thousands of wallets at once, which is exactly what happened here.

Keplr's help pages say Google-login accounts get their private key through Web3Auth and, unlike seed-phrase accounts, can only show that key rather than a recovery phrase, Coindaro noted.

Consensys bought Web3Auth in June 2025 and now markets the service as MetaMask Embedded Wallets, The Block reported. Keplr said in 2025 that it had more than 2 million users. Web3Auth has named only Keplr as affected so far.

Why it matters

This is not a smart contract bug or a phishing wave. It is a failure in the plumbing that many apps rely on to onboard newcomers without seed phrases.

Crypto Briefing summed up the trade-off: when a user holds their own recovery phrase or a hardware wallet, security depends mostly on them. When a provider manages the keys, one upstream flaw can hit everyone at once.

There is also no deposit guarantee in self-custody. Any refund depends on Keplr or Web3Auth choosing to pay, and as of Sunday neither had announced a compensation plan, according to crypto.news and Coindaro.

The episode also shows how messy real-time incident tracking can be. On-chain data shows that money moved, not why. A rescue that copies an attack looks like an attack until someone with more context explains it.

What Keplr users should do now

Keplr's guidance for anyone who created a wallet with Google or Apple login is short:

Do not send new funds to that account. Move any remaining liquid assets to a wallet secured by a recovery phrase or a hardware device.

Trust updates only from Keplr's or Web3Auth's official accounts, and ignore direct messages or links that offer "recovery." Scammers routinely target users after incidents like this.

Some accounts "may already show a reduced or empty balance as a result of these mitigation efforts," Keplr warned. An empty balance does not automatically mean theft, but it does not prove the funds were saved either. Staked and locked assets will take longer to secure, the company said.

What comes next

Several key details are still missing. Keplr says it is working with Web3Auth on a way for users to check whether their account was affected, but no date has been given.

Web3Auth says it will keep adding verified recovery addresses and share more once recovery operations are complete. It has not publicly explained how the attacker reached the keys.

Google and Apple login on Keplr remain paused, with no restart date. The next updates to watch are a final loss figure, a process for returning recovered funds, and whether any other Web3Auth client turns out to be exposed.