Keplr Wallet Breach: $6 Million Moved in Web3Auth Incident

On November 7, 2026, popular Cosmos wallet provider Keplr took emergency action by suspending all Google and Apple social logins following a serious security incident. The decision came after private keys linked to third-party authentication provider Web3Auth were exposed, leading to widespread unauthorized transactions across multiple blockchain networks.

Initial investigations by blockchain analytics firm Bitquery tracked approximately $6.01 million in asset transfers. However, the situation is nuanced because ethical security teams also executed protective rescue operations to save vulnerable funds.

What Caused the Keplr Wallet Security Breach?

To understand what happened, it helps to look at how different crypto wallets work. Typically, creating a Web3 wallet requires storing a 12-word or 24-word recovery phrase safely offline.

To make onboarding easier for everyday users, Keplr offered a social login feature powered by Web3Auth. This feature allowed users to log in with their Google or Apple credentials instead of managing a traditional seed phrase.

Think of it like using a hotel keycard system instead of a physical key. It offers great convenience, but if the hotel system has a flaw, electronic locks across the building might become vulnerable.

On Friday, November 6, 2026, Web3Auth reported a security flaw in its underlying infrastructure. By early Saturday morning, unauthorized transactions began occurring on Keplr wallets created using Google and Apple accounts.

Josh Lee, co-founder of Chainapsis (the developer team behind Keplr), clarified that the security vulnerability originated within Web3Auth's system, rather than Keplr's wallet software itself.

Estimates indicate that around 20% of all social-login accounts were exposed to potential risk. However, only a smaller fraction of those exposed wallets experienced actual unauthorized activity. Crucially, users protecting their wallets with hardware devices or traditional seed phrases were completely unaffected.

Inside the Data: $6 Million Transferred Across Cosmos Networks

Blockchain analytics firm Bitquery conducted an in-depth analysis of blockchain movements between November 6 and November 7, 2026. The firm identified wallet-draining activity across several Cosmos ecosystem networks, including Cosmos Hub, Osmosis, CelestiaTIA-5.08%, Akash, Noble, dYdX, BabylonBABY-10.06%, and InjectiveINJ-1.41%.

Based on market prices recorded on November 7, collector addresses received assets totaling roughly $6.01 million. Here is how those transfers were distributed across major networks:

• Cosmos Hub: Approximately $3.50 million in transferred tokens
• Osmosis: Approximately $1.04 million in transferred tokens
• Injective: Approximately $615,000 in transferred tokens

Bitquery tracked nearly 44,700 distinct private keys involved in these movements. Remarkably, 86% of the affected wallets across seven interconnected networks experienced transfers after Keplr issued its initial public security warning.

For most individual wallet owners, losses remained relatively small, with a median loss of $1.34. However, the largest single wallet transfer reached nearly $325,000.

The entities moving funds also utilized advanced liquid staking mechanisms to bypass standard network security delays. Normally, unbonding staked Cosmos (ATOM) tokens requires a 21-day waiting period.

By converting staked ATOM into liquid share tokens, roughly 1.96 million staked ATOM tokens became instantly transferable. This technique also allowed approximately $251,000 in accumulated staking rewards to be redirected.

White-Hat Security Rescues Complicate Theft Calculations

Although early reports highlighted a $6 million theft figure, official updates revealed a vital detail. Both Web3Auth and Keplr confirmed that ethical white-hat security teams were using the same exposed access paths to move vulnerable funds into safe custody.

On Sunday, November 8, 2026, Keplr published a list of verified recovery addresses. Several of these addresses matched collector wallets originally identified in Bitquery's report.

As a result, the observed $6.01 million total reflects all tracked asset movements, rather than a confirmed total of permanently stolen funds. Web3Auth assured users that assets secured through their protective operations remain safe.

Verified White-Hat Recovery Addresses

Keplr and Web3Auth verified the following official recovery addresses on November 8, 2026. Assets held at these addresses were moved for safekeeping during protective operations:

• Cosmos Hub: cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu
• Osmosis: osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw
• Celestia: celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53
• Akash: akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx
• Noble: noble1atuap9kfnt6y8ykvn3437e7j3z8qffh3ggxnkj
• Injective: inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7gd
• dYdX: dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt
• Babylon: bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239
• Axelar: axelar1atuap9kfnt6y8ykvn3437e7j3z8qffh3y99n9a
• Saga: saga1atuap9kfnt6y8ykvn3437e7j3z8qffh37c2ff6
• Agoric: agoric1atuap9kfnt6y8ykvn3437e7j3z8qffh3jk3y72
• EVM Address: 0x413e4F4De7E5FF010913488F781E679e76f706d

Action Steps for Keplr Social Login Users

If you have a Keplr wallet created via Google or Apple social logins, consider taking these immediate safety steps:

• Avoid new deposits: Do not send any additional funds to social-login accounts until teams issue full clearance.
• Move remaining liquid funds: Transfer liquid tokens to a newly generated wallet secured by a seed phrase or hardware wallet.
• Beware of recovery scams: Ignore direct messages on social platforms claiming to offer help or compensation links. Scammers frequently exploit security incidents.
• Wait for staked asset guidance: Rescued staked tokens will require formal administrative reconciliation before they can be redistributed.

Convenience vs Security in Web3 Development

This event underscores an ongoing debate in cryptocurrency user experience. While social logins lower barriers to entry for beginners, outsourcing key management introduces external infrastructure risks.

Neither Keplr nor Web3Auth has released the final technical root-cause analysis or announced a full reimbursement schedule yet. Until accounting teams distinguish malicious drains from white-hat rescues, the total loss remains under investigation.

Related Security Event: GnosisGNO+0.00% Pay Data Breach

In another security development, Gnosis Pay reported a data breach on Friday, November 6, 2026. Unauthorized actors gained access to its legacy consumer card system, exposing sensitive customer records. Gnosis Pay confirmed it has secured the system and is notifying affected customers.

Past performance of digital assets or financial products is not an indication of future performance or returns. Always verify recovery information through official project announcements.