Keplr Pauses Google and Apple Logins After Web3Auth Breach Drains $6M
Keplr suspended Google and Apple social logins on November 7 after unauthorized transactions were traced to accounts exposed through Web3Auth, a Consensys-owned authentication provider. Blockchain analytics firm Bitquery estimates about $6.01 million moved from roughly 44,700 wallets across Cosmos networks and Injective.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Keplr Disclosed
Keplr suspended Google and Apple login options in a November 7 security notice after receiving reports of unauthorized transactions on accounts created through social logins. The wallet said recovery-phrase and hardware-wallet accounts were unaffected in its initial assessment, and advised social-login users to stop sending funds to their accounts.
Keplr co-founder Josh Lee said the incident did not originate in Keplr's own wallet code. He attributed it to Web3Auth, an external authentication provider Keplr uses, and said roughly 20% of the platform's Google and Apple login accounts could be affected, though only a fraction had been exploited.
Where the Breach Sits
Web3Auth, which is owned by Consensys, lets users create and access wallets through existing online accounts without managing recovery phrases during onboarding. The provider acknowledged an infrastructure problem affecting certain embedded wallets used by Keplr and temporarily suspended its embedded wallet service while it investigated. Web3Auth said it had found no evidence that MetaMask users were affected, but it has not published a full list of other wallet providers exposed, and it has not publicly explained the technical entry point that allowed private keys to be compromised.
Scale of Transfers and Disputed Figures
Bitquery traced about $6.01 million in assets across two collection addresses tied to the November 6-7 incident. It identified 44,041 affected wallets across seven Cosmos networks and 7,603 addresses on Injective, and estimated roughly 44,700 distinct wallets after removing overlap. Cosmos Hub accounted for about $3.5 million of the total, with further transfers involving Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective.
The sources differ on how much of that activity reflects theft. Bitquery reported that about 86% of affected wallets on the linked networks sent outgoing transfers after Keplr's initial warning, and it recorded 1.96 million staked ATOM moved through staking-share tokenization, bypassing the usual 21-day unbonding period. Web3Auth later said its authorized recovery teams were moving assets along similar transaction paths. As a result, the recorded transfers cannot yet all be treated as confirmed attacker-controlled losses, since recovery addresses must be separated from malicious destinations.
Recovery Operations
With some vulnerable accounts still holding funds, Web3Auth and its partners have begun whitehat recovery operations intended to move assets to safety before attackers can access them. Neither Keplr nor Web3Auth has yet published a reconciled loss figure separating recovered assets from losses, and the root cause remains unexplained publicly.
Why It Matters
For Traders
Holders of ATOM and other Cosmos-ecosystem tokens should watch for further outflows and any reconciled loss figure, since the final total is still disputed between sources.
For Investors
The incident highlights concentration risk in third-party authentication infrastructure that many wallets rely on, which may draw scrutiny toward embedded-wallet providers.
For Builders
Teams using Web3Auth or similar embedded-wallet SDKs should audit their dependency on external key-management services and review their incident response and key-recovery plans.
This article is for information only and is not financial advice. Read the full disclaimer.
