Keplr Wallet has suspended Google and Apple login functionality after users reported unauthorized cryptocurrency transfers, with early estimates suggesting that approximately 20% of accounts created through social authentication may be vulnerable.
The November 7 incident has affected wallets across the Cosmos ecosystem, with community investigators reporting stolen assets involving Injective, Osmosis and Cosmos Hub. Initial loss estimates exceeded $700,000, although subsequent independent tracking suggests substantially larger outflows. Keplr has not confirmed an official loss total.
The security issue originated with Web3Auth , the third-party authentication provider that powers Keplr’s social login functionality. Both companies are investigating the compromise, while Keplr has warned affected users against depositing additional assets or attempting to recreate their wallets.
Keplr Co-Founder Says 20% of Social-Login Accounts May Be Exposed
Keplr confirmed unauthorized transactions involving Google and Apple accounts, distinguishing those wallets from accounts created through conventional recovery phrases or hardware devices.
The company said its preliminary investigation found no evidence that those other wallet types had been compromised through the Web3Auth incident.
Chainapsis co-founder Josh Lee, whose company develops Keplr, provided additional details , estimating that approximately 20% of social-login accounts could be affected.
However, he stressed that only a fraction of those potentially vulnerable accounts appeared to have been exploited, leaving open the possibility of recovering access to others.
Lee also clarified that the incident did not originate from a vulnerability in Keplr’s own application code.
Keplr’s social authentication system uses Web3Auth’s distributed key generation infrastructure, allowing users to create cryptocurrency wallets through existing Google or Apple accounts instead of manually managing recovery phrases.
The wallet’s security architecture generates private keys through Web3Auth and stores encrypted credentials locally. The exact mechanism enabling unauthorized transactions has not been disclosed.
Web3Auth Suspends Services as Loss Estimates Rise
Web3Auth acknowledged a security incident affecting third-party integrations on November 6 and temporarily disabled its embedded wallet service.
The company subsequently placed its login infrastructure into maintenance , confirming that precautionary measures were underway.
Web3Auth, acquired by MetaMask developer Consensys in 2025, said its initial investigation found no evidence that MetaMask users were affected.
Meanwhile, independent community investigators have traced suspicious movements involving ATOM, OSMO and INJ tokens, with some estimates now reaching several million dollars. Neither Keplr nor Web3Auth has verified those figures or disclosed the number of affected users.
The incident follows a series of attacks involving external cryptocurrency infrastructure.
On October 29, Polymarket suffered a $2.7 million wallet-draining exploit after malicious JavaScript entered its trading interface through a compromised monitoring provider.
Separately, BTCPay Server warned operators unauthorized hot wallet withdrawals linked to vulnerable software installations.
Keplr has instructed users who created wallets through Google or Apple authentication not to send additional funds to those accounts or re-import them into other applications while the investigation continues.
The team has also warned against unsolicited recovery assistance, fraudulent support messages and suspicious links claiming to restore stolen funds.
No reimbursement plan or timeline for restoring social login functionality has been announced. The investigation continues as Keplr and Web3Auth work to identify the affected accounts, determine the attack method and assess potential recovery options.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
