Made a Keplr Wallet With Google or Apple Sign-In? Move Unstaked Funds to a Recovery-Phrase or Hardware Wallet. Web3Auth Says It Swept 44,000 Wallets to Protect Them
If you created a Keplr wallet by signing in with Google or Apple, do not send new funds to it, and do not re-import or recreate it anywhere. Move any funds that are not staked or locked to a wallet that uses a recovery phrase or a hardware wallet. Keplr says wallets made with a recovery phrase or hardware wallet are not affected. That guidance is Keplr's, and we are repeating it from news coverage of it.
What happened
Keplr uses a service called Web3Auth to power its Google and Apple sign-in. Keplr and Web3Auth both said an attacker exploited a flaw at Web3Auth. Keplr described a "private key breach" for some users who signed in that way. Web3Auth called the issue a security problem in its own infrastructure affecting certain wallets it provides inside the Keplr app. Keplr has paused Google and Apple sign-in, and Web3Auth paused its embedded wallet service.
What neither company has said, as of the sources we read: how the flaw worked, when the attacker first used it, whether the route is closed, how much was stolen, or who the attacker is. No CVE has been published.
The part that confuses people: a rescue that looks like a theft
Web3Auth says it used the attacker's own route to move funds out of other at-risk wallets into recovery wallets, before the attacker could reach them. If your balance is zero, that may mean your funds were moved for safekeeping, not stolen.
The blockchain analytics firm Bitquery counted what it could see. Its figures, as of 15:38 UTC on November 7:
At least $6.01 million sitting in two addresses that Web3Auth lists as recovery wallets.
Those received funds from at least 44,041 Keplr social-login wallets on seven Cosmos chains, plus 7,603 on Injective.
The first sweep was at 20:52 UTC on November 6, about 21 minutes before Web3Auth's first public notice.
Keplr warned users at 04:38 UTC on November 7, and Bitquery counts 86% of the wallets as swept after that warning.
Bitquery first published this as a theft, then rewrote it after Web3Auth and Keplr disputed that and called the sweeps a whitehat recovery. The counts did not change. Bitquery says plainly that it cannot verify who controls the recovery wallets, and that its attribution rests on statements from the two companies. It reports no outbound transaction from the recovery addresses it checked. Treat "rescue" as the companies' claim that the chain data is consistent with, not as something independently proven.
Separately, GoPlus said at least about $1 million was stolen, without explaining its method. Keplr's co-founder gave an early estimate that about 20% of Google and Apple login accounts were affected, with only a fraction appearing exploited. Those are the only loss and exposure figures we have, and they are early and unconfirmed.
What to do
Do not add funds to a Google or Apple login account on Keplr.
Do not re-import or recreate that account elsewhere.
Move unstaked, unlocked funds to a wallet whose recovery phrase you hold, or to a hardware wallet. Keplr says staked and locked assets are taking longer to secure.
Trust only the official Keplr and Web3Auth accounts. Ignore direct messages and links offering "recovery." Scammers follow incidents like this one.
Web3Auth published a list of its recovery addresses so users can tell its transfers from possibly malicious ones, and warned not to assume an unfamiliar destination is the attacker's. We have not independently checked that list and are not reproducing addresses here.
Keplr says it is working with Web3Auth on a way to check whether your account was affected. Wait for that, not for a stranger's tool.
Web3Auth says the issue touches services used by some other companies and has named only Keplr. If you used Google or Apple sign-in to create a wallet in any other app, check whether it runs on Web3Auth. Web3Auth also said its initial investigation found "no evidence that MetaMask users are impacted." Consensys, MetaMask's maker, bought Web3Auth in June 2025.
How we know
We read The Hacker News report of November 9 and Bitquery's investigation. We could not open the Keplr and Web3Auth posts on X that those reports link, so what we attribute to the two companies is as quoted by those reports. Web3Auth's status page showed an outage banner on November 9. We have no indicators to add to our feed: the sources publish no transaction hashes, and the recovery addresses are unverified.
Sources
The Hacker News, "Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety," November 9, 2026. Bitquery, "Keplr wallet hack" investigation, November 6 to 8, 2026. Web3Auth status page, November 9, 2026.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Comments