The Keplr wallet hack has put users who signed in with Google or Apple on alert. Keplr paused both social-login options after unauthorized transactions affected some accounts, while stating that wallets created with a recovery phrase or a hardware wallet are not affected. Web3Auth, the provider of the embedded login technology behind the feature, suspended its service as part of the security response, and users with affected accounts were told not to deposit additional assets.

Early blockchain tracking placed more than $6 million at several on-chain addresses. Web3Auth later said many of the flagged destinations belong to its own recovery operation. That clarification changes how the on-chain flows should be read. It does not erase the unauthorized activity or establish a final loss total, and users must distinguish protective transfers from attacker-controlled withdrawals.

Keplr Wallet Hack Triggers Google and Apple Login Pause

Keplr's social-login feature let users open an account through Google or Apple instead of recording a recovery phrase, with Web3Auth infrastructure generating and accessing the wallet keys. The design reflected a broader push in consumer crypto to cut seed-phrase friction at onboarding, but it placed key generation and access with a third-party provider rather than solely with the user. Web3Auth first placed its embedded-wallet service on pause on November 6 and moved its Login Service into maintenance while investigators reviewed the security incident.

Keplr disclosed the next day that some social-login accounts had transactions their owners did not authorize. The company disabled Google and Apple login while it examined the incident together with Web3Auth.

What this means for Keplr users

If you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected.

In response to Web3Auth's infrastructure vulnerability leading to private key breach some Keplr users who signed in with Google or Apple, we are…

— Keplr Wallet (@keplrwallet) November 7, 2026

The hack affects the social-login route, not every Keplr account. Keplr's guidance is direct: do not send new assets to an affected account. Users should move any remaining liquid tokens to a separate recovery-phrase or hardware wallet.

A private-key breach can expose Cosmos balances at once. In Cosmos-based networks, addresses on different chains often share the same underlying key while carrying different prefixes, and that design can turn a single compromised key into an ecosystem-wide problem. It also explains why early tracking found activity on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, and Babylon.

Bitquery Traces at Least $6.01 Million to Eight Destinations

Blockchain analytics firm Bitquery, which published its findings in a public investigation page, traced at least $6.01 million to eight destinations. The firm recorded 44,041 drained wallets on seven linked chains and estimated the total number of victims near 44,700. Its research did not include unpriced tokens in the dollar total, and it logged a largest individual loss near $325,000.

The original figure is not a confirmed, final theft total. It reflects the value held by the named addresses at the investigation cutoff. Verified Web3Auth recovery wallets now help analysts separate stolen balances from assets transferred during the whitehat response, and that assessment may change as the companies reconcile individual transactions with users.

Keplr Wallet Hack Raises Recovery Wallet Questions

Web3Auth later reported that it began whitehat recoveries before an attacker could reach some vulnerable wallets, using the same access path to secure affected assets. As a result, a balance moving out of a social-login wallet does not automatically prove theft.

Cosmos Hub cosmos1atuap9kfnt6y8ykvn3437e7j3z8qffh3qtnmwu

Osmosis osmo1atuap9kfnt6y8ykvn3437e7j3z8qffh3gsqtcw

Celestia celestia1atuap9kfnt6y8ykvn3437e7j3z8qffh33pzt53

Akash akash1atuap9kfnt6y8ykvn3437e7j3z8qffh3ds7uhx

Noble noble1atuap9kfnt6y8ykvn3437e7j3z8qffh3ggxnkj

— Web3Auth (@Web3Auth) November 8, 2026

On November 8, Web3Auth published verified destinations for its recovery effort, and Keplr relayed the same list, saying the named addresses were not malicious or exploit addresses. The list included destinations across eight Cosmos chains, three additional Cosmos networks, and an EVM address covering eight chains.

Those Web3Auth recovery wallets overlap with addresses Bitquery had previously associated with the drain, and the overlap complicates the headline loss estimate. Web3Auth has not disclosed the value it secured, and neither company has provided a final loss reconciliation. There is no return process or technical postmortem yet. Those open items now frame what to watch: a technical postmortem explaining how the private keys were exposed, disclosure of the value Web3Auth secured during the whitehat response, and a decision on whether and how Google and Apple login returns to Keplr.

Keplr said some accounts may look empty because assets were moved during mitigation, and staked and locked assets require more time to secure. Users should not trust direct messages, give up recovery phrases, or send funds to a claimed rescue address.

The Keplr wallet hack remains a confirmed security incident with an unsettled financial tally. The key distinction is narrow but important: Web3Auth calls some transfer destinations protective wallets, while unauthorized activity affected social-login accounts. Until the companies publish a full reconciliation, the split between stolen and safeguarded funds remains unclear.