Keplr, a non-custodial crypto wallet widely used across the Cosmos ecosystem, has suspended Google and Apple social logins after users reported unauthorized transactions on accounts created with those methods. The company links the problem to Web3Auth, the third-party provider that powers the social login feature. Neither company has disclosed total losses, the root cause, or a timeline for a fix.

⚠️ALERT: Crypto wallets created with Google or Apple logins are being hit by unauthorized transactions. Keplr, the main wallet of the Cosmos ecosystem, paused both login options after users reported the thefts. The incident originated at Web3Auth, the login service owned by… pic.twitter.com/wYn5BFaxCg
— Coin Bureau (@coinbureau) November 7, 2026

https://x.com/coinbureau/status/2119097550808764482?ref_src=twsrc%5Etfw

Keplr says wallets set up with a recovery phrase or a hardware wallet are not affected. In a non-custodial wallet, users hold the private keys that approve transactions. Cosmos, the ecosystem where Keplr is most widely used, is a network of independent blockchains that communicate with one another through a protocol called IBC.

How the Incident Unfolded

The incident unfolded through a series of public statements on X. Web3Auth first flagged the issue in a post at approximately 21:13 UTC on November 6, 2026, saying a security issue was affecting services used by some third parties. The company simultaneously paused its embedded wallet service, which lets people sign in and transact inside an app without a separate wallet extension. Because that service is embedded in third-party apps rather than used by Keplr alone, the pause reaches beyond Keplr's own login options.

An early review found no evidence that MetaMask users were hurt, according to Web3Auth. Its status page lists the Login Service as under maintenance because of a security incident, and the company said it would share confirmed details once they were available.

Keplr posted its own statement at about 04:38 UTC on November 7. The wallet said it had received reports of unauthorized transactions on some accounts made with Google or Apple login, passed those reports to Web3Auth, and has worked with the Web3Auth team since.

Josh Lee, co-founder of Chainapsis, the company behind Keplr, shared early findings at approximately 08:29 UTC. He said the incident was not a hack of Keplr's own code and began at Web3Auth, adding that recovery phrase and hardware wallet accounts remain safe.

Which Accounts Are at Risk

Lee said the problem seems to hit some, but not all, Google and Apple login accounts. An early estimate puts the share at about 20%. Only a fraction of those accounts appear fully exploited so far, he said, and the rest may still be recoverable.

Social login lets users create a wallet with an existing Google or Apple account, replacing the recovery phrase — the list of words that can rebuild a wallet on any device. Keplr's support pages say Google login keys come from Web3Auth through distributed key generation, a process that splits key creation across several parties. The feature is meant to reduce onboarding friction — letting newcomers create a wallet with credentials they already have — but it also ties account security to the login provider's infrastructure, so an issue at the provider can affect every app built on the same login flow.

Keplr asked holders of possibly affected accounts to stop sending new funds to them and not to re-import or recreate those accounts in another wallet or app. Users should trust updates only from Keplr's official X account, the company said, and ignore direct messages or links that offer recovery help. Scammers often pose as support staff after wallet incidents to collect recovery phrases. Hardware wallet maker NGRAVE gave similar advice after a recent phishing attack.

Keplr is working with Web3Auth and MetaMask to track the affected accounts and try to recover funds. Consensys, the software firm behind MetaMask, bought Web3Auth on June 2, 2025. Lee said the situation is particularly hard because many social-login users are new to crypto.

What Is Still Unknown

Neither company has published the number of affected accounts or the value of assets involved. They have not named the chains or tokens hit, identified the root cause, or given a date for a fix. The 20% figure is an early estimate and not a confirmed count.

Some users on X claim losses beyond Keplr's stated scope, including older accounts and staked assets. These claims are unofficial, The Crypto Times could not verify them, and they conflict with parts of Keplr's assessment.

Other wallet security warnings came earlier in the week. BTCPay Server told users to shut down their instances after reports of hot wallet drains, while CertiK warned that the DarkSword iOS exploit can target crypto wallets on unpatched iPhones.

As of about 11:30 UTC on November 7, Web3Auth's embedded wallet service was still paused and Keplr had not restored Google or Apple login. Both companies said they would share verified details when available. How the story develops from here turns on three open items: a confirmed root cause, verified figures for affected accounts and losses, and the restoration of the suspended login methods.