Keplr Wallet Hack Impacts Google and Apple Login Users

What Happened with the Keplr Wallet Breach?

If you created a Keplr wallet using your Google or Apple login, your account may have been exposed to a security flaw. On November 6, Web3Auth—the service powering social logins for Web3 applications—paused its embedded wallet tools and put its login system into maintenance mode after detecting an issue.

Web3Auth initially noted that there was no sign of impact on MetaMask users, who had faced a separate security incident back in October. However, a day later, Web3Auth traced the vulnerability directly to its own infrastructure and confirmed that it affected certain Keplr wallets. Keplr reacted quickly by disabling Google and Apple sign-ins to protect users.

Importantly, Keplr confirmed that accounts created using traditional seed phrases or hardware wallets were not exposed to this specific vulnerability and remain safe.

How Many Wallets and Funds Were Impacted?

According to data from on-chain analytics firm Bitquery, approximately 44,700 Keplr wallets across eight Cosmos-based chains were affected by the incident. Bitquery tied over $6 million in token movements to the drain, with the single largest loss from an individual wallet amounting to roughly $325,000.

This security event adds pressure to an ecosystem that was already adjusting after earlier disruptions. In the spring, the popular Leap Wallet shut down, which led many Cosmos community members to migrate their assets over to Keplr.

Rescued Funds vs. Stolen Assets: The Whitehat Operation

While initial reports indicated a total loss of $6 million, part of those funds may actually be safe. Web3Auth explained that it quickly launched a whitehat rescue operation alongside its security partners. The team used the same access path to move vulnerable assets out of at-risk wallets before attackers could reach them.

Because on-chain asset transfers look identical whether executed by a hacker or a rescue team, several blockchain observers initially mistook Web3Auth's rescue transfers for part of the exploit. To clear up the confusion, Web3Auth published a list of verified recovery wallet addresses across multiple networks:

• InjectiveINJ+0.00%: inj1lqmdmuczn5rxn5jkc34wwrqdeh70etpf5wvt7g
• dYdX: dydx1atuap9kfnt6y8ykvn3437e7j3z8qffh3fjalwt
• BabylonBABY+0.00%: bbn1atuap9kfnt6y8ykvn3437e7j3z8qffh3h4z239
• Axelar: axelar1atuap9kfnt6y8ykvn3437e7j3z8qffh3y99n9a
• Saga: saga1atuap9kfnt6y8ykvn3437e7j3z8qffh37c2ff6
• Agoric & 8 EVM Chains: Additional verified addresses provided by Web3Auth

Bitquery noted that several of these verified addresses share keys with collector wallets previously linked to the initial drain. Web3Auth has not yet publicly confirmed the exact dollar value of the funds it secured, but it stated that all recovered funds are safe.

Next Steps for Users and Wider Crypto Context

Web3Auth stated that it is currently working with the Keplr team to coordinate a safe mechanism for returning recovered tokens to their original owners. The team also issued a strong warning advising users to watch out for impersonators on social platforms offering fake recovery assistance.

Following the news, other decentralised applications moved to reassure their communities. PancakeSwap clarified that its own platform, funds, and smart contracts remain fully secure and unaffected by the Web3Auth issue.

This incident highlights ongoing cybersecurity challenges across the digital asset space. Reports indicate that North Korean hacking organizations stole an estimated $7.61 billion in 2026 alone. In another separate recent event, an attacker managed to drain over 1,400 Qubic wallets, highlighting the continuous need for robust security practices across all Web3 tools.