Threat watch / Attack
Keplr: a flaw at login provider Web3Auth exposes the keys of Google and Apple sign-in wallets
On November 6, Web3Auth put its login service into maintenance "due to a security incident". Keplr, a Cosmos crypto wallet that uses Web3Auth for Google and Apple sign-in, reported unauthorized transactions on some of those accounts and paused both logins. Web3Auth then used the same access path to move funds from wallets still at risk into recovery wallets: at least $6.01M from about 44,700 wallets, according to Bitquery. Neither company has said how much the attacker took or how the flaw worked.
- Sector
- Finance
- Way in
- Supplier
- Product or vendor
- Keplr, Web3Auth
- How it happened
- Through Keplr's login provider: Web3Auth describes a security issue in its own infrastructure affecting certain wallets it provides inside the Keplr app, and Keplr speaks of a private key breach for some users who signed in with Google or Apple. Keplr's co-founder Josh Lee says it was not a hack of Keplr's code. How the flaw worked is not public.[2][4] Checked 9 Nov 2026
- What was stolen
- Crypto from some Keplr wallets created with Google or Apple sign-in. The amount the attacker took is not public: GoPlus says at least about $1 million, without explaining the figure. The $6.01M counted by Bitquery is mostly funds Web3Auth says it moved to safety, not confirmed theft.[2][3] Checked 9 Nov 2026
- Who was impacted
- Keplr users whose wallet was created with Google or Apple sign-in: about 44,700 such wallets had funds moved, and Josh Lee's early estimate is that about 20% of these accounts were affected, with only a fraction exploited. Wallets made with a recovery phrase or a hardware wallet are not affected. Web3Auth says other companies use the affected services but names only Keplr; it says it found no evidence that MetaMask users are affected.[2][3][4] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- Web3Auth places its login service in maintenance mode "due to a security incident". The first transfer out of affected Keplr wallets comes at 20:52 UTC, 21 minutes before Web3Auth's first public notice, according to Bitquery. Web3Auth says it has started a whitehat recovery of wallets that are vulnerable but not yet hit. [1][3]
- Keplr says: "We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login." It pauses both logins and asks users not to send new funds and to move unlocked funds to a recovery-phrase or hardware wallet. 86% of the wallets were emptied after this warning, according to Bitquery. [2][3][4]
- Web3Auth lists its recovery addresses and says some transfers "have been mistaken for attacker activity". Bitquery corrects its first analysis, which had counted the transfers as theft, and says it cannot verify who holds the recovery wallets. No source attributes the attack. [3][4][5]
- Neither company has explained the flaw, said whether it is closed, or said how and when the moved funds will be returned. [2][4]