Keplr Wallet suspended all Google and Apple social login functionality on November 6, 2026, following reports of unauthorized transactions targeting users who bypassed traditional seed phrases. The breach originated from a security vulnerability in the infrastructure of Web3Auth, the service provider responsible for generating private keys for these embedded social accounts.
This incident highlights a critical friction point in Web3 adoption: the trade-off between user experience and cryptographic sovereignty. While social logins allow users to interact with the Cosmos ecosystem—holding assets like ATOM, OSMO, and INJ—without managing a 12 or 24-word recovery phrase, they shift the burden of security from the individual to a centralized infrastructure provider. The vulnerability in Web3Auth’s system meant that the very convenience designed to onboard mass users became the primary vector for asset theft.
Web3Auth infrastructure vulnerability exposes private keys
The technical mechanism behind the breach involves the way social logins handle key management. In a standard non-custodial setup, a user’s device generates a private key locally, which is then expressed as a recovery phrase. However, for Keplr users utilizing Web3Auth’s “embedded wallet” service, the private key is generated via a distributed key generation process. This method splits the key into fragments stored across different actors, which only recombine during the login session to provide a "one-click" experience.
We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since. Based on our initial assessment: if you created your Keplr wallet… https://t.co/EoXTC9ehpP
On November 7, 2026, Web3Auth confirmed that a flaw in its own infrastructure led to the exposure of these private keys. Because the service generates the private key on behalf of the user in lieu of a manual recovery phrase, any compromise at the provider level grants an attacker full control over the resulting wallet.
The impact is specifically concentrated on the Cosmos ecosystem. Community investigators have already tracked suspicious movements involving Injective (INJ), Osmosis (OSMO), and the Cosmos Hub (ATOM). While the exact number of compromised accounts and the total value of stolen assets remain unconfirmed, Josh Lee, co-founder of Chainapsis (the developer of Keplr), estimated that approximately 20% of social-login-enabled accounts could be at risk, though only a subset has been actively exploited.
How Keplr rescues threatened funds through emergency transfers
In a move to mitigate further losses, funds from threatened but not yet exploited wallets have been moved to secure locations through emergency transfers.
To distinguish between a theft and a legitimate rescue, Web3Auth has committed to publishing a verified list of destination addresses where the saved funds have been moved. Users are advised not to assume an unknown destination address belongs to an attacker until this list is cross-referenced. Keplr is currently developing a dedicated tool to help users verify their account status, though no official release date for this utility has been set.
Security comparison: social login vs. self-custody
The distinction between the affected accounts and safe accounts is binary, based entirely on the method of account creation. The following table outlines the technical differences between the compromised architecture and standard secure practices.
| Feature | Web3Auth Social Login | Standard Seed Phrase | Hardware Wallet |
|---|---|---|---|
| Key Generation | Distributed via third-party infra | Local device generation | On-device secure element |
| Recovery Method | Google/Apple OAuth | 12/24 word mnemonic | Physical device/Seed phrase |
| Single Point of Failure | Web3Auth Infrastructure | User’s physical/digital backup | Physical possession of device |
| Keplr Status (Nov 2026) | Suspended/At Risk | Safe | Safe |
Immediate mitigation steps for Keplr users
Until Web3Auth restores its embedded wallet services and provides a full forensic report, users must operate under a high-alert protocol. The following actions are necessary for those using social logins:
Keplr paused Google and Apple login after reports of unauthorized transactions Here's what we know so far: – Some Keplr accounts created with Google or Apple login had funds moved without the owner's approval – Keplr flagged it to Web3Auth, the provider behind its social login,… pic.twitter.com/s41GPKC4rD
- Cease all deposits: Do not send new funds or staking rewards to any Keplr account created via Google or Apple.
- Migrate remaining balances: Create a new Keplr account using a traditional recovery phrase or link a hardware wallet, then transfer all available liquid assets to this new address.
- Avoid re-importing: Do not attempt to re-create or import the social-login account into other applications while the investigation is ongoing.
- Ignore unsolicited assistance: Be vigilant against phishing attempts. No legitimate support entity from Keplr or Web3Auth will ever ask for a private key or recovery phrase via direct message.
Frequently asked questions
If my Keplr balance is zero, was I hacked?
Not necessarily. Rescue transfers are currently being used to protect threatened funds. You must wait for Web3Auth to release the official list of verified destination addresses to confirm if your funds were moved by the company or stolen by an attacker.
Are MetaMask users affected by this Web3Auth incident?
As of the current investigation, there is no evidence that MetaMask users are impacted. While Web3Auth has been owned by Consensys (the developer of MetaMask) since 2025, the breach is specifically linked to the embedded wallet services used by third-party providers like Keplr.
KEPLR PAUSES GOOGLE AND APPLE LOGIN AFTER UNAUTHORIZED TRANSACTION REPORTS It urged those users to stop adding funds. Keplr says recovery-phrase and hardware-wallet accounts are unaffected in its initial assessment. Read more here:https://t.co/gSwl6wzEnq
