Key Takeaways
- Keplr said on November 7, 2026, that a private key breach at its login provider Web3Auth let an attacker make unauthorized transactions from some Keplr wallets created with Google or Apple login.
- Keplr wallets made with a recovery phrase or a hardware wallet were not affected by the Web3Auth breach, Keplr said, and it paused Google and Apple login while it investigates.
- Web3Auth moved funds out of exposed Keplr wallets before the attacker reached them, and its recovery wallets held $6.01 million from at least 44,041 wallets on seven Cosmos chains as of November 7, 2026, blockchain data firm Bitquery found.
- Neither Keplr nor Web3Auth had given a figure for the cryptocurrency the attacker stole from Keplr wallets as of November 9, 2026; security firm GoPlus said at least about $1 million had been stolen.
What happened
Some users of Keplr, a cryptocurrency wallet app for the Cosmos family of linked blockchains, found their wallets emptied late on November 6, 2026, according to an investigation by blockchain data firm Bitquery. The affected wallets had been created with a Google or Apple account instead of a recovery phrase, the backup list of 12 or 24 words that most wallets use.
Keplr uses a company called Web3Auth to run that Google and Apple sign-in. An attacker used a security flaw at Web3Auth to reach the wallets, both companies said, The Hacker News reported. Keplr described the incident as a "private key breach" for some users who signed in with Google or Apple. A private key is the secret code that approves payments from a wallet, so whoever holds it can move the money.
Web3Auth's status page says the company placed its login service into maintenance from 6:30 p.m. UTC on November 6 "due to a security incident." Keplr warned its users on X at 04:38 UTC on November 7 and paused Google and Apple login, Bitquery reported.
The rescue and the money
Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, and moved that money into recovery wallets for safekeeping with Keplr's help, according to The Hacker News. Web3Auth said its "whitehat recovery" targeted Keplr wallets that were vulnerable but not yet affected, CryptoSlate reported. Keplr said some reduced or empty balances could reflect these mitigation efforts, according to CryptoSlate.
Bitquery counted at least 44,041 Keplr wallets on seven Cosmos chains and 7,603 on Injective that sent funds to two addresses Web3Auth now lists as recovery wallets. Those addresses held $6.01 million at 15:38 UTC on November 7, the firm said. Most wallets held little. The median wallet sent $1.34, and the largest single wallet sent $325,000.
Bitquery first reported the transfers as theft and later corrected its analysis to treat them as the rescue. It said it cannot check who controls the recovery wallets. The recovery later restarted on other chains, and those transfers are not in the $6.01 million total, Bitquery said.
What is still unknown
Neither company has given a dollar figure for the theft itself, The Hacker News reported. Keplr co-founder Josh Lee estimated that about 20% of Google and Apple login accounts were affected, and that only a fraction of those appeared to have been exploited. Web3 security company GoPlus said at least about $1 million had been stolen, without explaining how it reached that figure, according to The Hacker News.
Neither company has said how the flaw worked, when the attacker first used it, or whether that route is now closed, The Hacker News reported. Neither has named an address belonging to the original attacker, according to Bitquery. Web3Auth has not said how or when it will return the rescued funds to users.
Who else is affected
Web3Auth said the issue affects its services used by some other companies, but Keplr is the only one it has named, The Hacker News reported. Web3Auth paused its embedded wallet service, which other apps use to build wallets for their users.
Consensys, the company behind the MetaMask wallet, bought Web3Auth in June 2025. In a November 7 announcement on the MetaMask Builder Hub, MetaMask said it had temporarily paused the Embedded Wallet service and, after an initial investigation, found no evidence that MetaMask users are impacted.
What Keplr users should do
Keplr's guidance for accounts created with Google or Apple login, as reported by The Hacker News and CryptoSlate:
-
•
Do not send new funds to the account.
-
•
Do not re-import the account or recreate it anywhere.
-
•
Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
-
•
Trust updates only from the official Keplr and Web3Auth accounts, and ignore direct messages or links that offer "recovery."
Staked and locked assets are taking longer to secure, Keplr said. Web3Auth has published a list of its recovery addresses so users can tell its transfers apart from possibly malicious ones, and it warned users not to assume that an unfamiliar destination address belongs to the attacker, according to The Hacker News. Keplr is also working with Web3Auth on a way for users to check whether their account was affected, The Hacker News reported.