TLDR:
- The Keplr wallet hack affected Google and Apple sign-in accounts, while Keplr says recovery-phrase and hardware-wallet accounts remain outside the incident scope.
- Web3Auth paused its embedded-wallet service, Keplr froze social login, and users with affected accounts were told not to deposit additional assets.
- Bitquery initially tracked about $6.01 million across eight destinations, but the figure needs review after Web3Auth labeled those addresses as recovery wallets.
- The companies have not released a final loss total, technical root-cause report, return process, or accounting of assets moved in whitehat recoveries.
Keplr wallet hack reports have put Google and Apple login users on alert. Keplr paused both social-login options after unauthorized transactions affected some accounts. The wallet says recovery-phrase and hardware-wallet accounts are not affected. Web3Auth, which provides embedded login technology, paused its service during a security response. Initial blockchain tracking placed more than $6 million at several on-chain addresses.
Yet Web3Auth later said flagged destinations belong to its recovery operation. That clarification changes how the on-chain flows should be read. It does not erase unauthorized activity or establish a final loss total. Users must distinguish protective transfers from attacker-controlled withdrawals.
Keplr Wallet Hack Triggers Google and Apple Login Pause
Keplr’s social-login feature lets users open an account through Google or Apple instead of recording a recovery phrase. The flow relied on Web3Auth infrastructure to generate and access wallet keys. Web3Auth first placed its embedded-wallet service on pause November 6. It also moved the Login Service into maintenance while investigators reviewed a security incident.
Keplr disclosed the next day that some social-login accounts had transactions their owners did not authorize. The company disabled Google and Apple login while it examined the incident with Web3Auth. The Keplr wallet hack affects the social-login route, not every Keplr account. Its guidance is direct: do not send new assets to an affected account. Users should move any remaining liquid tokens to a separate recovery-phrase or hardware wallet.
A private-key breach can expose Cosmos balances at once. Cosmos chains use one key across related addresses, even though their prefixes differ. That design can turn a single compromised key into an ecosystem-wide problem. It also explains why early tracking found activity on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, and Babylon.
Bitquery traced at least $6.01 million to eight destinations. It recorded 44,041 drained wallets on seven linked chains and estimated total victims near 44,700. The research did not include unpriced tokens in its dollar total. For the Keplr wallet hack, it logged a largest individual loss near $325,000.
The original figure is not a confirmed, final theft total. It reflects the value held by named addresses at the investigation cutoff. Verified Web3Auth recovery wallets help analysts clearly separate stolen balances from assets transferred during the whitehat response. That assessment may change as the companies reconcile individual transactions with users.
Keplr Wallet Hack Raises Recovery Wallet Questions
Web3Auth later reported that it began whitehat recoveries before an attacker could reach some vulnerable wallets. The company used the same access path to secure affected assets. As a result, a balance moving from a social-login wallet does not automatically prove theft.
On November 8, Web3Auth published verified destinations for its recovery effort. Keplr relayed the same list and said the named addresses were not malicious or exploit addresses. The list included destinations across eight Cosmos chains, three additional Cosmos networks, and an EVM address covering eight chains.
Those Web3Auth recovery wallets overlap with addresses Bitquery had previously associated with the drain. That overlap complicates the headline loss estimate. Web3Auth has not disclosed the value it secured, and neither company has provided a final loss reconciliation. There is no return process or technical postmortem yet.
Some accounts may look empty because assets were moved during mitigation, Keplr said. Staked and locked assets require more time to secure. Users should not trust direct messages, give up recovery phrases, or send funds to a claimed rescue address.
The Keplr wallet hack remains a confirmed security incident with an unsettled financial tally. The key distinction is narrow but important: Web3Auth calls some transfer destinations protective wallets, while unauthorized activity affected social-login accounts.