Keplr: Google and Apple Logins Paused After Users Report Transfers They Never Approved

At 21:13 UTC on 6 November 2026, Web3Auth, a company that lets apps offer crypto wallets behind a Google or Apple login, posted a short warning on X. It was aware of "a security issue affecting Web3Auth's services used by some third parties", it said, and had "temporarily paused the embedded wallet service". About seven and a half hours later, at 04:38 UTC on 7 November, Keplr, one of the most widely used wallets in the Cosmos family of blockchains, said users of its Google and Apple sign-in had been reporting transactions they never approved.

Keplr paused both sign-in options. Neither company has said how many people were hit, how much was taken or how the thieves got in. At the latest check, 16:06 UTC on 7 November, that was still the position, and both companies had promised more details without publishing any.

What Keplr and Web3Auth have said

Keplr is a wallet app and browser extension for Cosmos, a network of linked blockchains whose best-known coins are ATOM (the Cosmos Hub), OSMO (Osmosis, a trading platform) and INJ (Injective). The wallet is built by Chainapsis. A wallet is the app that holds the secret key to a person's crypto, the way a bank card holds the means to spend from an account, except that anyone who copies the key can empty the account and nobody can reverse the transfer.

Keplr's post said it had "received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login". It had flagged the reports to Web3Auth and had been working with the company on an investigation. Its first assessment drew one line: a wallet created with a recovery phrase or a hardware wallet is "NOT affected". An account made with Google or Apple login "may be affected".

Web3Auth said that after an initial investigation it had "found no evidence that MetaMask users are impacted". MetaMask is the best-known wallet in the Ethereum world. Web3Auth is owned by Consensys, the company behind MetaMask, according to Crypto Adventure and AirdropAlert, which both reported that it was acquired in 2025. A second Web3Auth post said it would share confirmed details, and steps for users of affected services, when it had them.

Social login and a recovery phrase

A recovery phrase is a list of 12 or 24 ordinary words that is the wallet. Whoever holds the words controls the money. The owner writes them down and keeps them safe, which is secure but awkward, and many beginners lose them or store them badly.

Social login removes that chore. A person taps "Sign in with Google" and a wallet appears, with no words to write down. Keplr's security documentation, as quoted by The Defiant, says these accounts use Web3Auth to generate a private key rather than a recovery phrase, and that the key is encrypted and stored on the user's own device. AirdropAlert described the design as one where pieces of the key live with a third party and are put together at login. That description is AirdropAlert's, not Keplr's or Web3Auth's.

The trade is one a share trader would recognise from using a broker instead of holding paper certificates. Convenience goes up, and so does reliance on the company in the middle. A hardware wallet is a small physical device that keeps the key offline, and Keplr counts it, like the recovery phrase, as unaffected.

How big is it

Nobody has confirmed a loss. Crypto Adventure, a news site, wrote that community investigators had traced stolen assets in ATOM, OSMO and INJ, that early estimates exceeded $700,000 and that later independent tracking suggested larger outflows, "several million dollars" by some estimates. It said neither Keplr nor Web3Auth had verified any of this. CMZ has not found a second source for those figures, so they are not used as a loss total here.

The same article quoted Josh Lee, a co-founder of Chainapsis, as estimating that about 20% of social-login accounts could be vulnerable, and as saying that only a fraction of those appeared to have been exploited. It also reported Lee as saying the problem did not come from a flaw in Keplr's own app code. A GitHub incident log that tracks security events describes the 20% as the co-founder's early estimate, and lists confirmed victim totals, loss, cause and compensation as open. The figure is one outlet's report of one person's early estimate. Neither company has repeated it in its own posts.

Reports in English and Chinese (PANews, BigGo Finance, Bloomingbit, KuCoin's news feed) repeat the two company statements and add no numbers. The Defiant noted that neither statement named a cause, put a figure on losses or counted affected accounts. AirdropAlert said the same. No cause has been given, and none is guessed at here.

Other apps on Web3Auth

Web3Auth said the issue affects "services used by some third parties", without naming them. The company's own earlier posts show how widely its login is used. They mention Pearl, an app store for AI agents from Autonolas, including an agent that trades on the prediction market Polymarket, the game MapleStory Universe, and a developer programme run with Linea and the infrastructure firm Infura. Those posts are partnership announcements. None of the firms has said it is affected, and the posts do not show which services are covered by the pause.

The incident follows a run of wallet losses that did not start with a bug in the wallet itself. In late October a hacked website tool drained about $2.65 million from Polymarket traders, and on 31 October at least 12 crypto websites were hijacked to send visitors to wallet-draining pages.

What happens next

Keplr's instructions to users with Google or Apple accounts are, in its words: do not send new funds to that account, do not re-import or recreate it anywhere, and trust updates only from its own X account. It also warned users to ignore direct messages or links offering "recovery", a common second wave in which scammers pose as helpers. Keplr did not tell users to move their money out. It said Google and Apple login are paused "for now".

Crypto Adventure reported that no refund plan and no timetable for restoring social login had been announced. Keplr said it would share verified details and next steps on X as soon as it had them.