Keplr Wallet has suspended Google and Apple social logins after unauthorized transactions drained funds from accounts created through those methods. On-chain investigators traced approximately $6.01 million in losses from more than 44,000 wallets across Cosmos-related networks. The incident is linked to a security issue at Web3Auth, the third-party provider powering the social-login feature, rather than a vulnerability in Keplr’s own code.
Keplr confirmed reports of unauthorized activity on November 7, 2026, paused the affected login options, and advised users that recovery-phrase and hardware-wallet accounts remain unaffected. The company is coordinating with Web3Auth on investigation and potential recovery. Funds were swept primarily on Cosmos Hub, Osmosis, and several other chains, with some activity continuing after the initial public warning.
The Drivers of the Current Situation
The drain targeted wallets created via Google or Apple login, which rely on Web3Auth’s infrastructure for key management and authentication. Web3Auth reported a security issue affecting services used by certain third parties and placed its embedded wallet service into maintenance. Keplr’s co-founder later estimated that roughly 20% of social-login accounts may have been exposed, though only a fraction appear to have been fully exploited so far.
Bitquery’s analysis identified at least 44,041 affected wallets on seven Cosmos chains plus additional addresses on Injective, with the attacker consolidating assets into two addresses that had not yet moved funds further. Notably, the attacker was able to move staked ATOM without the usual unbonding period in some cases. A significant portion of the drains (around 86% in tracked data) occurred after Keplr issued its public warning, highlighting the speed of the automated sweeps.
Keplr has emphasized that traditional seed-phrase and hardware-wallet users face no exposure under its initial assessment. The company and Web3Auth have referenced ongoing white-hat recovery efforts aimed at protecting remaining vulnerable accounts, which may result in temporary balance reductions or clearances on some social-login wallets as assets are secured.
Impact and Broader Context
The episode underscores risks associated with social-login and “seedless” wallet designs that depend on third-party authentication providers. While the absolute dollar amount is moderate relative to larger crypto incidents, the high number of affected wallets and the targeting of newer or less experienced users (who often prefer Google/Apple logins) amplify the reputational and ecosystem impact within Cosmos.
For Keplr and the broader Cosmos community, the event raises questions about dependency on external authentication services, the trade-offs between user convenience and self-custody security, and the effectiveness of rapid response and recovery mechanisms. Seed-phrase and hardware-wallet users remain insulated, reinforcing longstanding best-practice recommendations. Recovery of staked or locked assets is described as more complex and time-consuming.
Investigations continue, including efforts to recover or safeguard remaining funds and determine the precise technical entry point at Web3Auth. Users with social-login accounts have been advised not to deposit additional funds, not to re-import those accounts elsewhere, and to move any remaining liquid assets to safer wallet types. Further updates from Keplr and Web3Auth will shape the final loss figures and remediation outcomes.
This analysis draws on Keplr’s official statements, Bitquery’s on-chain investigation, related coverage from November 7–8, 2026, and comments from Keplr’s co-founder. The full scope of exposure, recovery success rates, and any additional affected services remain subject to ongoing technical review and disclosure.