Keplr suspends Google and Apple logins after a Web3Auth key-generation flaw leads to unauthorized transactions
November 6, 2026 (November 6 to 8, 2026)
Users of Keplr wallets created with Google or Apple sign-in reported unauthorized transactions, and Keplr suspended both login methods on November 6, according to CryptoTicker. The keys for those accounts are generated by Web3Auth, which confirmed a security incident and temporarily suspended its embedded wallet service. CryptoTicker reports that on November 7 Web3Auth attributed the incident to a vulnerability in its own infrastructure that exposed private keys. Neither company has said how attackers got in. Bitquery traced about $6 million in transfers on November 6 and 7 across seven Cosmos networks and Injective, involving about 44,700 wallets. Web3Auth says some of the flagged addresses are its own verified recovery wallets, used to move at-risk funds, including one holding about $3.5 million on Cosmos Hub, so that figure overstates theft by an unknown amount. Neither Keplr nor Web3Auth has published a loss figure. Keplr's preliminary review is that accounts with their own seed phrase or a linked hardware wallet are not affected, and Web3Auth says it has no indication that MetaMask users are affected. No fix, refund or date for restoring social login has been announced.
Why it matters
When one provider generates keys for many wallets, one flaw reaches all of them at once. Empty balances may be rescue transfers rather than theft, so users need the providers' verified address list before drawing conclusions.
What defenders can take from it
- Users of Keplr social login: make no new deposits, and move freely available coins to a wallet with your own seed phrase. Do not re-import the account elsewhere.
- Ignore unsolicited recovery offers, and never enter a seed phrase or private key on a site or in a message.
- Wallet providers: treat key-generation infrastructure as the highest-value target, and publish verified rescue addresses early so users can tell rescue from theft.