Keplr suspends Google and Apple logins after key breach

Keplr has stopped users from signing in through Google and Apple after a breach in third-party authentication infrastructure exposed some private keys, according to Blockonomi. Blockchain intelligence firm Bitquery traced roughly $6.01 million to eight destinations across Cosmos networks, but that figure is not a confirmed loss total.

The wallet provider’s co-founder, Josh Lee, estimated to crypto.news that about 20% of accounts opened with Google or Apple could be affected, with a smaller number actually exploited. Lee attributed the failure to Web3Auth, the authentication provider Keplr uses, and said the incident was not a compromise of Keplr’s own wallet code.

Key facts

• Web3Auth placed its embedded-wallet service on pause on November 6 and moved its login service into maintenance while a security incident was investigated; Keplr disabled Google and Apple sign-in the next day, November 7.
• Bitquery recorded about $6.01 million across two collection addresses, 44,041 wallets on seven linked Cosmos chains, 7,603 affected addresses on Injective, and an estimated 44,700 distinct wallets after overlaps — the extra address counts come from crypto.news.
• Cosmos Hub accounted for roughly $3.5 million of the recorded assets, and Bitquery logged a largest single loss near $325,000, per Blockonomi.
• Bitquery found 1.96 million staked ATOM being moved through staking-share tokenization, sidestepping the usual 21-day unbonding period.
• About 86% of affected wallets on the seven linked networks saw outgoing transfers after Keplr’s first warning, according to Bitquery’s work as reported by crypto.news.

Recovery wallets blur the loss estimate

Web3Auth said it began moving funds out of vulnerable wallets before an attacker could reach them, using the same access path that the breach exposed. On November 8 it published a verified list of its recovery destinations covering eight Cosmos chains, three additional Cosmos networks and an EVM address spanning eight chains. Keplr relayed the list and said none of the named addresses are malicious or exploit addresses.

Those recovery wallets overlap with addresses Bitquery had already logged as drain destinations, so a balance leaving a social-login account does not on its own prove theft. Neither company has published a final loss reconciliation, a technical root-cause report or a return process for users, and Keplr has not said whether confirmed losses will be reimbursed.

Keplr’s November 7 security notice said reports of unauthorized transactions had arrived on accounts created with Google or Apple login and that wallets set up with a recovery phrase or hardware device were unaffected. Web3Auth said it found no evidence that MetaMask users were impacted and has not listed other wallet providers that might share the exposure.

What users were told to do

Keplr advised people with social-login wallets to stop depositing new assets and to move any remaining liquid tokens to a separate recovery-phrase or hardware wallet. Some accounts may show reduced or empty balances because assets were shifted during mitigation, the company said, and staked or locked positions take longer to secure.

Users were also warned against unsolicited messages or links offering asset recovery and told not to hand over recovery phrases or send funds to an address presented as a rescue wallet. Blockonomi reported that the companies had not released a final loss total, a root-cause report, a return process or an accounting of whitehat recoveries.

Cosmos chains reuse one key across related addresses despite different prefixes, which explains why activity surfaced on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX and Babylon from a single key compromise. The episode follows earlier wallet-credential failures — the Injective software compromise in July and an October Qubic seed-generation flaw, both cited by crypto.news — though those traced to different causes.

Why it matters

Social login is marketed as a way to open a wallet without writing down a seed phrase, and this incident shows that the convenience depends on a third party whose failure can reach every key it generated. The affected group is narrow — Google and Apple sign-in users rather than all Keplr accounts — but because Cosmos keys cover linked addresses, a single exposed key can reach balances across several networks at once.

What to watch

The next signals are a reconciled loss figure, a technical postmortem explaining how private keys were exposed, a method for checking whether an account was affected, and a decision on reimbursements. Watch also for a reclassification of the Bitquery destinations once recovery addresses are separated from attacker-controlled ones.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Blockonomi, crypto.news