Summary

  • Keplr suspended Google and Apple social logins on November 7 2026 after a Web3Auth breach enabled unauthorized transactions.
  • Attackers drained at least $6 million from Cosmos ecosystem wallets linked to the keplr wallet social login feature.
  • Roughly 44,700 wallets were swept, raising immediate concerns for users relying on third-party authentication in non-custodial setups.

Keplr paused Google and Apple logins on November 7 2026. Reports traced the trouble to a Web3Auth flaw. Private keys for affected accounts had leaked, and attackers drained funds across Cosmos chains.

Users who signed up through social login faced immediate risk. The incident showed how third-party services can undermine wallet security promises.

The pause came after at least 44,700 wallets were swept. Keplr acted within hours to limit further exposure.

Context

Non-custodial wallets in the Cosmos ecosystem have long pushed user-controlled keys. Social login through Web3Auth aimed to ease onboarding. Yet it created an external dependency that stored or derived keys outside direct user control.

This choice created a single point of failure. The recent breach exploited it.

The keplr wallet incident follows a pattern in other wallets that used similar services. Cosmos security assumes users keep sole custody of keys. Social login shifted part of that responsibility to a third party. When the third party fell, the model broke for affected accounts.

Details

The Web3Auth breach exposed private keys for keplr wallet users who signed up with Google or Apple. Attackers used those keys to move funds. At least $6 million left eight different Cosmos wallets. The vulnerability hit accounts created through social login, which makes up around 20 percent of Keplr's users.

Keplr disabled the login methods at once. The company told users to skip social login recovery for now. They should monitor official channels. Trust Wallet products that also use Web3Auth stayed unaffected.

"A Web3Auth infrastructure vulnerability exposed private keys for some Keplr wallets created through Google or Apple social login."

, Source (cryptotimes.io)

The root cause sat in Web3Auth's embedded wallet service. Attackers could reconstruct control over addresses without user devices or seed phrases once the infrastructure gave way. This fact clashes with the security model sold for non-custodial Cosmos wallets.

Outlook

Keplr keeps investigating the full breach. It will announce next steps for social login once the vulnerability is fixed. Users should switch to seed-phrase or hardware recovery now. They need to watch for official guidance on safe access restoration.