Keplr Wallet exploit: Web3Auth flaw hits social login users

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

If you set up your Keplr Wallet through a Google or Apple account, do not deposit any new funds into it for now. Keplr suspended Google and Apple login on November 6, 2026, after users reported unauthorised transactions. According to the companies involved, the cause lies with the service provider Web3Auth, which generates the keys for these accounts on Keplr's behalf. Accounts with their own seed phrase and accounts linked to a hardware wallet are not affected, based on Keplr's preliminary review.

Keplr is a multi-chain wallet with its main focus on the Cosmos ecosystem. It is developed by the company Chainapsis. Many investors use it to hold and stake coins such as ATOM, OSMO or INJ. The incident therefore hits precisely the group that wanted the most convenient possible wallet setup: no slip of paper with 12 or 24 words, just a click on "Sign in with Google".

Keplr Wallet exploit: what is known the unauthorised transactions

According to a Crypto Adventure report dated November 7, 2026, users reported outflows from wallets they had created with a Google or Apple login. Keplr then switched off sign-in through both services and opened an investigation together with Web3Auth. Josh Lee, co-founder of Chainapsis, estimated according to the same report that around 20 percent of social login accounts could be affected, while only some of them were actually exploited.

No confirmed loss figure exists so far. Neither Keplr nor Web3Auth has put a number on the affected accounts or the value of the drained coins. Community estimates circulating on social media vary widely and have not been confirmed by either company. The only reliable distinction so far is based on how an account was created.

Crypto Adventure also reports that Lee stressed the flaw does not sit in the code of the Keplr app itself. That changes little for victims, but it explains why Keplr cannot handle the recovery on its own.

Web3Auth pauses embedded wallets: the response on November 6

On November 6, Web3Auth confirmed a security incident affecting services used by some third-party providers. The company temporarily suspended its service for so-called embedded wallets. An embedded wallet is one that an app builds directly into its own product, so the user needs neither separate wallet software nor a recovery phrase of their own.

After an initial investigation, Web3Auth says it found no indication that MetaMask users are affected. There is a reason for that statement: according to Crypto Adventure, Web3Auth has belonged to Consensys, the developer of MetaMask, since 2025. Anyone who uses MetaMask the classic way with their own seed phrase is, on everything known so far, untouched by this incident.

At its core, a wallet is a private key. Whoever knows it controls the coins. With a classic wallet, the user's device generates this key and displays it as a seed phrase, a sequence of 12 or 24 words from which the key can be derived again at any time.

Social login works differently. According to the Keplr documentation cited in a KuCoin News report from November 7, Web3Auth generates the private key for accounts with Google login instead of a seed phrase. Web3Auth uses distributed key generation: the key is split into shares that are stored in different places and only work together again at login. The user sees none of this and simply signs in with a Google or Apple account.

That convenience comes at a price. The security of the account no longer depends on the user alone but also on the provider's infrastructure. If a component fails there or comes under attack, the user can do nothing it, however carefully the Google account itself is protected.

Cause according to Web3Auth: an infrastructure flaw exposed private keys

On November 7, according to KuCoin News, Web3Auth named a cause for the first time: a vulnerability in its own infrastructure that led to private keys being leaked. Some users who had signed in through Google or Apple were affected. Neither company has yet disclosed exactly how the attackers exploited the flaw. Web3Auth said it would further details once the recovery of funds is complete.

The known part is enough to put the incident in context. Anyone holding a wallet's private key needs no password and no confirmation from the owner. Such a drain cannot be reversed by a chargeback either, because transactions on a blockchain are final.

Protective transfers at Keplr: why a balance can be empty without an attacker

One detail is causing confusion among those affected. According to KuCoin News, Web3Auth and its partners have started moving funds out of wallets that have not yet been attacked but are at risk. By their own account, they used the same route as the original attacker. Keplr therefore warned that some Google or Apple login accounts may show a reduced or empty balance after this rescue.

An empty account does not automatically mean the coins have been stolen. According to the report, Web3Auth is compiling a verified list of the addresses to which rescued funds were sent. This should allow users and the teams of the affected blockchains to tell legitimate rescue transfers apart from the attacker's transactions. Web3Auth said nobody should rush to attribute an unknown destination address to the attacker.

Keplr also says it is working with Web3Auth on a way for users to check for themselves whether their account is affected. No date has been given for it yet.

Cosmos, Injective and Osmosis: the blockchains where outflows were spotted

According to Crypto Adventure, community investigators traced suspicious movements involving Injective (INJ), Osmosis (OSMO) and Cosmos Hub (ATOM). That fits the profile of a wallet used mainly in the Cosmos ecosystem. Neither Keplr nor Web3Auth has published an official list of affected networks.

If you hold Cosmos (ATOM) or Injective (INJ) , what matters is where your coins sit. Coins held on an exchange or in a wallet with your own seed phrase are not caught up in this incident. To see which wallet apps work entirely without a third-party key service, see our software wallet comparison .

What happened: On November 6, 2026, Keplr users reported unauthorised transactions from wallets created with a Google or Apple login via Web3Auth. Web3Auth attributes the incident to a flaw in its infrastructure that exposed private keys. As of November 7, there is no confirmed loss figure.

Are you affected? You may be affected if you created a Keplr account through "Sign in with Google" or "Sign in with Apple". If you created your Keplr Wallet with a seed phrase or connected it to a hardware wallet, you are not affected according to Keplr's preliminary review. So far, the only way to tell whether an individual social login account was attacked is to look at the balance and the transactions in a block explorer.

No deposits: Do not send new funds or staking rewards to a Keplr account with Google or Apple login until Keplr re-enables the service.

Move the remaining balance: Create a new account with your own seed phrase in Keplr or another wallet and move freely available coins there, as Keplr advises those affected.

No re-import: Do not import the social login account into another app and do not recreate it while the investigation is ongoing.

Ignore fake rescuers: Do not to any direct message offering to recover your coins, and never enter a key or seed phrase anywhere.

Wait for the address list: If your account shows an empty balance, compare the destination address with the rescue list Web3Auth has announced before you assume theft.

Our guide how to store crypto safely explains the basics of secure storage, and the hardware wallet comparison sets the right devices side by side.

Seed phrase or hardware wallet: these Keplr accounts remain untouched

With a seed phrase wallet, the private key is created on the user's device and never leaves it. No service provider holds any part of it. A hardware wallet goes one step further: it is a small dedicated device that stores the key and signs every transaction itself, so the key never even reaches the computer or smartphone.

That separation explains why the Web3Auth incident only affects social login accounts. The flip side: lose the seed phrase and you lose access for good, and nobody can help. A copy on paper or a stamped metal plate kept in a safe place therefore belongs with every wallet that has its own key.

Staking on Keplr: locked coins slow down the rescue

Many Keplr users stake their coins, meaning they delegate them to a validator to earn rewards. In the Cosmos ecosystem, staked coins cannot be moved immediately; unbonding them involves a waiting period. According to KuCoin News, Keplr pointed out that staked and locked balances make the rescue more complicated and slower.

For those affected, this means freely available coins can be moved to a secure account as Keplr advises, but locked coins cannot simply follow. If you have staked holdings on a social login account, follow Keplr's announcements on its official X account, which the wallet says it uses to verified updates.

Phishing after the Keplr incident: fake helpers in direct messages

Every major incident brings out scammers posing as support staff or recovery services. Keplr explicitly warned against unsolicited recovery offers, fake support messages and links promising to retrieve stolen coins. No reputable provider will ever ask for a seed phrase or a private key.

A safe route always goes through the provider's official website or official account, which you open yourself, never through a link someone sends you. A genuine rescue offer from Keplr or Web3Auth would be announced publicly, not distributed by private message.

Keplr after Web3Auth: new money only into accounts with your own seed phrase

As of November 7, no refund and no date for the return of social login have been announced. Until Keplr delivers a checking tool and Web3Auth publishes the address list, the safe course is to move to an account with your own key. Three steps get you there:

Choose a device: For larger holdings, a hardware wallet offers the strongest protection; models with Cosmos support are listed in the hardware wallet comparison .

Wallet app with seed phrase: For smaller amounts, a software wallet where you generate the recovery phrase yourself is enough; providers are listed in the software wallet comparison .

Keep trading separate: Coins you want to trade belong on an exchange licensed under the EU's MiCA regulation; the comparison of regulated crypto exchanges gives an overview.

(As of November 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions Keplr and Web3Auth

Keplr accounts created with a Google or Apple login via Web3Auth may be affected. Accounts with their own seed phrase or linked to a hardware wallet are not affected, according to Keplr's preliminary review.

Besides the attacker, Web3Auth and its partners moved funds out of at-risk social login wallets to secure them. An empty Keplr account can therefore be a rescue transfer; Web3Auth has announced a verified list of rescue addresses.

No. Keplr advises against sending new funds to accounts with Google or Apple login and recommends moving freely available coins to an account with a seed phrase or a hardware wallet.

Web3Auth says an initial investigation found no indication that MetaMask users are affected. Web3Auth has belonged to Consensys, the developer of MetaMask, since 2025.

As of November 7, 2026, there is no confirmed loss figure. Neither Keplr nor Web3Auth has disclosed the number of affected accounts or the value of the drained coins.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Section: All crypto hacks and scams at a glance

Dogecoin news: Why Mishaboar warns against social login wallets

Trust Wallet Phishing: Fake .cam Site Also Targets Phantom and OKX Wallet

Restoring a Crypto Wallet: Your Seed Phrase Gets the Coins Back

Binance hacker sold 499.9 billion SHIB in eight minutes, and the Shiba Inu price barely moved

Foundation Passport: 23,000 phishing emails came from the wallet maker's own systems

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

November 2, 2026 9:43 PM

How to store crypto safely: protect yourself from hacks like the one at Binance

After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.

November 2, 2026 9:25 AM

Trezor Safe 5 implant reported at CryptoBilis: who needs a new wallet now

Trezor is warning everyone who has ordered from former reseller CryptoBilis since March 2026: an extra board with a cellular module in a Safe 5 is said to read the recovery phrase. Who is affected, why weighing the device does not help, and how to move to a new wallet.

October 29, 2026 3:40 PM

$13.84 million in 48 hours: Arkham says the drainer is “still moving funds”

Arkham Intelligence puts the haul of the CryptoBilis Ledger drainer at 95.35 million dollars across 1,486 addresses and reports 13.84 million dollars moved within 48 hours. Ten million USDT sit frozen, and Ledger traces every confirmed case back to one retail route.

October 26, 2026 12:15 AM

Coldcard class action over $140 million: what it means for owners

A proposed class action against Coldcard maker Coinkite is before a court in Ontario: a firmware flaw allegedly made recovery phrases predictable, and the claim puts the Bitcoin drained as a result at more than $140 million. What owners of an affected device should check and document now.

October 25, 2026 12:35 PM

Private key and public key: 256 bits decide who owns your coins

A private key is a secret number with 78 digits, and the public key can be calculated from it, while the way back cannot. Signature, seed and address all hang on it, and at an exchange or in your own wallet this single value decides who owns the coins.

October 23, 2026 10:21 PM

Ngrave phishing: $2.56 million left 70 wallets after a hijacked push provider

Attackers hijacked the push provider of Belgian hardware wallet maker Ngrave and sent fake security alerts to users of the LIQUID app on October 17. Anyone who entered their recovery words lost their balance: between $2.56 million and $2.65 million flowed out, while the devices themselves remained untouched according to the company.

October 19, 2026 1:14 AM

Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point

An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.

October 17, 2026 10:44 PM

Creating a Bitcoin wallet: the first ten minutes decide who has access

A Bitcoin wallet is set up in ten minutes, and that is precisely the danger. Which four steps every setup runs through, why the first transfer should be a test amount, and which five mistakes cost the most.

October 14, 2026 1:30 PM

What is a hardware wallet? How the device protects your keys

A hardware wallet stores no coins, only the private key, and it never releases it. How signing works inside the device, what the 12 or 24 words mean, and which attacks the design cannot stop.

October 13, 2026 1:16 AM

Ledger Confirms Implant in a Hardware Wallet as Reports Reach Europe: What Is Behind It

Ledger confirms an unauthorised additional circuit board in a tampered device and traces the confirmed cases to a reseller in South-East Asia. One report from European retail is still open, which makes the purchase route of your own device the criterion.

October 9, 2026 5:36 PM

Ledger Hack? $86 Million Drained: What Is Behind the Tampered Wallets From Southeast Asia

Since Friday, Ledger users in Southeast Asia have been reporting empty wallets, and analysts count more than $86 million. Ledger has halted the reseller CryptoBilis. An implant inside the device reportedly reads the seed phrase. What is known, what CZ advises and what you should do now.

October 5, 2026 1:36 PM

Paper Wallet with a Single Key: The Printed Storage Method Compared with the Seed Phrase

A paper wallet carries a single private key on paper, and that is exactly where its weaknesses lie: printers, change, misread characters. What the storage method achieves, where it fails and how to wind up an old sheet safely.

October 2, 2026 10:36 AM

Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are

Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.

September 30, 2026 7:16 AM

Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet

The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.

September 25, 2026 1:47 PM

Magic Eden and Limit Break exploit: 530 WETH and thousands of NFTs drained, how to revoke your approvals

A bug in Limit Break's Payment Processor, the protocol behind Magic Eden's former Ethereum marketplace, has been draining NFTs and WETH since Thursday. Our blockchain analysis shows 911 affected wallets. What happened, why hardware wallets do not protect you and which two approvals to revoke now.

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

September 17, 2026 4:14 PM

D'CENT App Wallet: How to Tell If Your Recovery Phrase Has to Move Now

Manufacturer IoTrust reports suspicious asset transfers in the D'CENT app wallet and asks users to move their holdings. One question decides the matter: has your recovery phrase ever been entered into the app?

September 10, 2026 1:14 PM

Phishing Email From the Real Sender Address: How to Check a Wallet Security Warning

An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes.

September 10, 2026 9:13 AM

Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack

Trezor users received a fake STM32 entropy warning sent from a real Trezor address. Here is what happened and what to do if you clicked.

August 31, 2026 1:22 PM

Cosmostation Wallet Shutdown on September 1: What Cosmos Wallet Users Should Know Now the Deadline Has Passed

Recap as of September 27, 2026: Cosmostation had announced it would discontinue its wallet apps on September 1, 2026, leaving only the export of the recovery phrase and the private key. This article describes the situation before the deadline and how to move Cosmos holdings, including delegated ATOM.

August 25, 2026 10:31 PM

Crypto Wallet Phishing by Letter: Why the QR Code From Your Postbox Wants Your Recovery Phrase

Letters carrying a QR code urge a supposedly urgent wallet update on grounds of quantum resistance and lead to a page that asks for the recovery phrase. The Federal Office for Cybersecurity reported the ploy on August 18, 2026.

August 22, 2026 10:29 AM

Bitcoin Fork: What Happens to Your Coins When the Chain Splits

On October 31, 2026 a new chain called ECX splits off from Bitcoin, and every holder is credited automatically. Who actually receives the coins depends on the private keys, on voluntary replay protection and on a tax rule many overlook.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

August 11, 2026 1:32 PM

How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

The Coldcard case pushed the manufacturer question to the front, while barely touching on where the backup is kept. This guide places paper, steel, the passphrase and splitting methods against the BIP-39 and SLIP-0039 standards.

August 4, 2026 1:21 PM

Coldcard Losses Near $114 Million as a Fourth Sweep Hits: Why Is Bitcoin Rising Anyway?

A fourth wave of Coldcard sweeps took another 449 BTC on Monday, yet Bitcoin climbed back toward $64,000. Here is what changed and who is still exposed.

July 31, 2026 3:54 PM

594 BTC Gone in 25 Minutes: The Coldcard Flaw That Made Seed Phrases Guessable

A firmware bug from March 2021 let an attacker drain $38 million from around 500 Bitcoin wallets. Here is what broke, who is exposed and what to do now.

More from CryptoTicker