Keplr wallets made with Google or Apple sign-in hit by Web3Auth flaw

If you opened a Keplr crypto wallet with the “Sign in with Google” or Apple button, check it now. A flaw at Web3Auth, the outside company that made the keys behind those buttons, has let someone take funds from some of those wallets. Keplr has turned both sign-in options off. People who set up their wallet the old way, with a recovery phrase, or who use a hardware wallet, are not affected, it says.

Keplr is a widely used wallet for the Cosmos family of blockchains. It confirmed the problem on X at 5.38pm NZDT on Saturday 7 November: “We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login.” About seven hours earlier, Web3Auth had said it was aware of a security issue affecting services that third parties use, and had paused its embedded wallet service. Its status page still lists the Login Service under maintenance “due to a security incident”.

We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since.

Based on our initial assessment: if you created your Keplr wallet… https://t.co/EoXTC9ehpP

— Keplr Wallet (@keplrwallet) November 7, 2026

Early on Sunday NZDT, Web3Auth went further, posting that “we have identified a security issue in Web3Auth infrastructure affecting certain embedded wallets used by Keplr.” Keplr has described it as an infrastructure vulnerability that led to a private-key breach. Neither company has said how the attacker got in.

Who is affected

It all comes down to how the wallet was made. According to Keplr’s own help pages, Google sign-in accounts use Web3Auth to generate a private key, and those accounts get a raw private key instead of the usual 12- or 24-word recovery phrase. Web3Auth, now sold by MetaMask as Embedded Wallets, normally splits that key into several shares held in different places, so no single party should be able to rebuild it alone.

Josh Lee, a Keplr co-founder, gave an early estimate that about 20% of Google and Apple accounts were affected, and said only a fraction of those appeared to have been emptied. He was blunt about where the fault sat:

Initial findings and some clarifications on the Google/Apple login incident.

First, to those affected: I'm sorry, and we're doing everything we can.

1. This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses.

All other Keplr accounts,…

— josh lee (@dogemos) November 7, 2026

Some X users have claimed recovery-phrase wallets were drained too. Lee replied: “Seed phrases and hardware wallets are unaffected.” Keplr’s latest update says the same. We have not seen evidence that contradicts the companies’ account.

Why some balances are empty on purpose

There’s a twist that has confused plenty of people looking at their balances. Web3Auth says it and its partners began “whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker.” Put simply, the rescuers are racing the thief through the same open door. Web3Auth says recovered funds are safe and that some of these transfers have been mistaken for theft.

Keplr warned that “some Google/Apple-login accounts may already show a reduced or empty balance as a result of these mitigation efforts.” Staked and locked tokens take longer to deal with. Web3Auth says it will publish a verified list of recovery addresses so users and blockchain teams can tell rescue transfers from malicious ones, and Keplr says it is building a way to check whether an account is affected.

Blockchain analytics firm Bitquery has published its own count: at least 44,041 wallets across seven Cosmos chains, plus 7,603 on Injective, sent funds to two addresses that it says held about US$6 million. Neither Keplr nor Web3Auth has confirmed a figure. Until the official recovery addresses are published, outside tallies cannot reliably separate attacker sweeps from protective transfers, so treat any loss estimate as provisional.

What to do if you used Google or Apple sign-in

Keplr’s advice has changed as the picture has become clearer. Its first post told people not to re-import their accounts anywhere. Its later update asks Google and Apple sign-in users to:

• Stop sending new funds to that account.
• Move any remaining liquid tokens to a Keplr account created with a recovery phrase, or to a hardware wallet.
• Trust updates only from the official @keplrwallet and @Web3Auth accounts, and ignore direct messages or links that offer “recovery”.

Both companies have warned that unofficial offers of recovery help may be phishing, and Web3Auth told users not to assume an unfamiliar destination address belongs to the attacker. Wallets created with a recovery phrase or a hardware device need no action, Keplr says.

Web3Auth said earlier it had found no evidence that MetaMask users were affected. It has not named any other apps that rely on the paused service. If you use another wallet that offers email or social sign-in, check that app’s official channels to see whether it uses Web3Auth. Web3Auth says it will share more detail once its recovery work is complete.