Keplr suspends social logins after $6M wallet breach

Keplr said in a November 7 security notice that it had received reports of unauthorized transactions from accounts created through Google or Apple sign-in. The company traced the issue to Web3Auth, a Consensys-owned authentication provider, and said the breach was not caused by Keplr’s wallet code. Web3Auth acknowledged an infrastructure problem affecting certain embedded wallets used by Keplr and temporarily suspended that service. It said it had found no evidence that MetaMask users were affected.

Keplr co-founder Josh Lee estimated that roughly 20% of accounts using social logins could have been exposed, but said only a fraction had been exploited. Bitquery traced approximately $6.01 million in assets across two collection addresses linked to the November 6–7 incident. Its researchers identified 44,041 wallets across seven Cosmos networks and 7,603 affected Injective addresses. After accounting for overlap, they estimated about 44,700 distinct affected wallets.

Cosmos Hub accounted for about $3.5 million of the recorded assets. Transfers also involved Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective. Bitquery reported outgoing transfers from approximately 86% of affected wallets on the seven linked networks after Keplr’s initial warning. It also identified transfers involving 1.96 million staked ATOM, moved using staking-share tokenization that avoided the usual 21-day unbonding period.

Not all recorded transfers are confirmed thefts. Web3Auth said its whitehat recovery teams were moving assets through similar transaction routes to protect accounts, making some recovery transfers look like unauthorized drains. Keplr warned that balances in some social-login wallets could appear reduced or empty during recovery; staked and locked assets may take longer to secure. The companies have not announced a final total recovered or returned, and Keplr has not established whether customers will be reimbursed for confirmed losses.

Keplr advised Google and Apple login users not to add funds to potentially compromised wallets and to move any remaining liquid assets to accounts secured with a recovery phrase or hardware wallet. It said wallets created with recovery phrases or hardware devices were not affected. The company is working with Web3Auth on a way for users to check their accounts and warned against unsolicited recovery offers and links.