Bitquery Traces $6.01M Theft to Keplr Wallets Created via Google and Apple Logins

At least $6.01 million was drained from Keplr wallets between November 6 and 7, 2026, with the losses tracing back to exposed private keys tied to accounts created through Google or Apple sign-ins. Blockchain analytics firm Bitquery followed the money, and its findings point to the convenient social-login option — not the wallet's traditional seed phrase setup — as the weak link.

That distinction matters for anyone currently holding assets in Keplr. The reported exposure involves social-login accounts, the ones where a user taps "Sign in with Google" or "Sign in with Apple" instead of writing down a list of seed words.

How the Drain Unfolded

Bitquery's analysis identified roughly 44,700 distinct wallets touched by unauthorized transactions. Its breakdown counted 44,041 wallets on Cosmos ecosystem chains and 7,603 on Injective.

The Cosmos Hub took the biggest hit, with approximately $3.5 million of the losses coming from that chain alone. A portion of that figure involved staked assets: about 1.96 million staked ATOM moved out without going through the usual 21-day unbonding period. That 21-day wait is a built-in feature of Cosmos Hub's staking system — after an unstaking request, tokens normally stay locked for 21 days before they can be transferred.

The timing data added another troubling layer. Bitquery traced 86% of the drained funds on linked networks to transactions that occurred after Keplr issued its initial warning on November 7, 2026. Put plainly, most of the money left after users had already been told something was wrong.

Where the Blame Is Landing

Keplr, the wallet's developer, attributed the breach to a security vulnerability in Web3Auth, the third-party service that manages the social login flow and handles wallet keys for those accounts. Web3Auth confirmed that a vulnerability in its infrastructure exposed the private keys of some third-party users, and said the protective measures it took coincided with the attacker's transaction patterns.

Keplr co-founder Josh Lee indicated the breach affected an estimated 20% of accounts created using social logins, adding that only a fraction of those had been fully exploited so far. Keplr suspended Google and Apple logins immediately and began recovery efforts for affected accounts.

As of November 8, 2026, neither Keplr nor Web3Auth had disclosed the exact technical cause of the breach, published a precise total for losses, confirmed the number of impacted accounts, or detailed how much money can be recovered.

Why Social Logins and Recovery Phrases Are Different Animals

A crypto wallet is ultimately controlled by a private key, and whoever holds that key can move the funds. The classic way to back that key is a recovery phrase, usually a string of 12 or 24 words. The user writes it down, stores it somewhere safe, and the responsibility sits entirely with them.

Social logins exist because recovery phrases are, frankly, a poor user experience for newcomers. Services like Web3Auth let users sign in with familiar Google or Apple accounts instead. The tradeoff is that key management leans on outside infrastructure, and when that infrastructure has a flaw, the keys it helps manage can be exposed — which is what Web3Auth says happened to some users in this case.

The reported damage in this incident clusters around accounts created through Google and Apple logins. Users who set up Keplr with a traditional recovery phrase were not the focus of the reported key exposure.

What This Means for Users and the Cosmos Ecosystem

The immediate priority for affected users is simple: anyone with a Keplr account created through Google or Apple should treat it as potentially exposed and follow Keplr's recovery guidance.

The breadth also underscores Keplr's role across the interchain: one wallet application serving Cosmos ecosystem chains and Injective alike, which in this case meant a single compromised login pathway touched balances on multiple networks at once.

The 86% post-warning figure is the detail worth sitting with. Because a large share of the losses occurred after users were alerted, how quickly wallet providers can reach their users during an active incident may matter as much as the fix itself.

The open questions remain the ones to track. Keplr and Web3Auth still need to explain the exact technical cause, confirm the final loss total and the number of affected accounts, and spell out how much users can expect to get back. Whether and on what terms Keplr restores the suspended Google and Apple login option is another development worth watching. Until those answers arrive, the $6.01 million traced by Bitquery stands as a floor rather than a final tally.

The underlying analysis was reported in greater detail by Crypto Briefing.