Keplr Social-Login Wallets Affected by Web3Auth Security Flaw

Web3Auth flaw reaches some Keplr social-login wallets

Some Keplr users who created wallets through Google or Apple sign-ins were affected by a security flaw in infrastructure provided by Web3Auth. The incident is not described as a general compromise of every Keplr wallet: the stated exposure concerns a particular wallet-creation route. Keplr says accounts created with a recovery phrase or hardware wallet face no risk, drawing a clear distinction between social-login accounts and those other wallet setups.

Web3Auth provides login tools that allow applications to create crypto wallets through social accounts. On November 6, it paused its embedded wallet service and placed its login service into maintenance. The company initially reported no sign of impact on MetaMask users, whose users had faced a separate security incident in October. A day later, Web3Auth traced the flaw to its own infrastructure and confirmed that some Keplr wallets were affected.

After the confirmation, Keplr disabled Google and Apple sign-ins. That action limits use of the affected sign-in options, but the supplied account does not say when they will be restored or whether every affected account has been secured. Bitquery counted roughly 44,700 affected Keplr wallets across eight Cosmos-based chains. The scale spans multiple networks, although the count does not itself establish how much each user lost or whether every counted wallet was drained.

How the incident affected Keplr users

Bitquery tied more than $6 million to the drain and reported that the largest single loss was about $325,000. Those figures describe the on-chain activity identified in its tracking; they should not be read as a confirmed final loss for users. Web3Auth says some addresses treated as attacker wallets are actually its recovery wallets. As a result, the headline total may include funds moved into custody for safekeeping, though the company has not quantified that portion.

The sequence matters for understanding the response. Web3Auth says it began a whitehat operation with partners and moved funds out of vulnerable wallets before the attacker reached them, using the same access path. Transfers from those wallets could therefore resemble theft when viewed without the company’s explanation. The company says the destination addresses it identified belong to its recovery operation, but the source does not provide a complete transaction-by-transaction accounting of the transfers.

On November 8, Web3Auth published verified addresses covering Injective, dYdX, Babylon, Axelar, Saga, Agoric and eight EVM chains. Several of those addresses share a key with collector wallets Bitquery had linked to the drain. That overlap helps explain why some activity was interpreted as attacker-controlled. It does not, on its own, establish the final status or ownership of every tracked asset; Web3Auth says the identified addresses are used for recovery.

Recovery wallets complicate the on-chain picture

Web3Auth says funds recovered through the operation are safe and that it is working with Keplr on a way to return them. It has not said how much of Bitquery’s tracked total it secured, so users and observers cannot yet reconcile the more-than-$6-million figure with the funds held for safekeeping. The stated recovery effort is encouraging for affected users, but the amount, timing and exact process for distribution remain unresolved in the available information.

The episode also shows why wallet-transfer labels can be difficult to interpret during an active incident. A transfer out of a vulnerable address may represent an attacker’s action or a protective move by a response team; in this case, Web3Auth says its team used the same access path as the attacker. Publishing verified addresses offers a way to identify some recovery wallets, but it does not replace a fuller accounting or confirm the destination of every affected balance.

Web3Auth warned users about impersonators offering fake recovery help. That warning is practical in a situation where users are waiting for an official return process and may be approached by people claiming they can restore funds. The company says it is coordinating with Keplr, but the source gives no specific recovery instructions or deadline. Users should distinguish the announced recovery effort from unsolicited offers rather than treating an informal claim as proof of access to funds.

Fund recovery and broader security questions

Keplr’s response is also relevant to users who rely on social sign-in rather than a recovery phrase or hardware wallet. The wallet team says those latter account types face no risk from this incident, while Google and Apple sign-ins were disabled after the flaw was confirmed. The information does not detail individual account remediation or explain whether affected users need to take additional steps. The distinction in wallet setup is the clearest guidance provided in the incident account.

The incident arrives after disruption in the Cosmos ecosystem earlier in the year: the shutdown of Leap Wallet pushed many Cosmos users toward Keplr, according to the supplied account. That history provides context for why a Keplr security issue may matter across the community, but it does not establish that Leap’s shutdown caused the flaw or the losses. Other projects also sought to reassure users; PancakeSwap said its funds and smart contracts remained safe.

The Keplr case adds to a broader run of security incidents cited in the report, including North Korean hackers taking $7.61 billion in 2026 and an attacker recently emptying more than 1,400 Qubic wallets. Those examples establish a wider security backdrop, not a connection to the Web3Auth flaw. The central unresolved questions here are how much of the tracked crypto Web3Auth protected, how recovered assets will be returned, and when the disabled sign-in options can safely resume.

Source: BeInCrypto