Keplr Wallet has suspended Google and Apple login after reports of unauthorized transactions, warning that users who registered through the affected social authentication methods could be exposed. According to the company's preliminary assessment, accounts created using traditional recovery phrases or hardware wallets were not affected.

The wallet provider has advised potentially affected users to avoid depositing additional funds, refrain from re-importing or recreating their accounts, and rely exclusively on official communications while the investigation continues.

Keplr Flags Google and Apple Login Accounts

In a security statement issued on November 6, Keplr identified accounts established through Google and Apple login as the group potentially affected by the unauthorized transactions.

"If you created your Keplr account with Google or Apple login, your account may be affected," Keplr said.

The company issued specific instructions designed to help users limit further exposure while investigators examine the incident. Holders of potentially affected accounts were told to stop transferring new funds into those wallets and to avoid attempting to restore, re-import, or recreate the accounts through other services.

Keplr also cautioned users against responding to unsolicited direct messages or following links claiming to offer wallet recovery assistance, directing them to its official X account for verified security updates and instructions.

The warning applies specifically to accounts created through the affected social login methods, rather than to all Keplr wallets.

Web3Auth Infrastructure Under Investigation

The distinction between account creation methods matters because Keplr relies on different approaches to wallet authentication and private key management. According to Keplr's security documentation, accounts created through Google login use Web3Auth technology to generate a private key rather than a conventional 12-word or 24-word recovery phrase. The documentation states that the generated private key is encrypted and stored locally on the user's device.

That architecture reflects a common trade-off in wallet onboarding: social login removes seed-phrase management from the user's responsibilities, but in exchange it ties account generation to the authentication provider's underlying infrastructure. Because that infrastructure can serve multiple applications at once, a problem at the provider level can extend beyond any single wallet app, which is a central reason the incident involves both Keplr and Web3Auth rather than one company alone.

Keplr is working with Web3Auth to investigate the reported unauthorized transactions, although neither company has publicly established the underlying cause of the security issue. Keplr's initial findings indicated that users who set up their wallets with recovery phrases or hardware wallets were not affected, an assessment that remains preliminary while the investigation continues.

Web3Auth Temporarily Suspends Embedded Wallet Service

Web3Auth separately acknowledged the security problem in a statement issued on November 6, confirming that an issue had affected its services as used by certain third-party applications. The wallet infrastructure provider said it had temporarily paused its embedded wallet service, which allows applications to integrate cryptocurrency wallet functionality directly into their platforms.

The suspension is a separate precautionary measure from Keplr's decision to disable Google and Apple login.

Web3Auth also addressed potential concerns involving MetaMask, stating that its initial investigation had not identified evidence of an impact on MetaMask users.

"After an initial investigation, we've found no evidence that MetaMask users are impacted," Web3Auth said.

The statement did not establish the full scope of the incident across other applications built on Web3Auth infrastructure.

Cause and Financial Impact Remain Unconfirmed

Neither Keplr nor Web3Auth has disclosed how the unauthorized transactions occurred, and neither company has provided an estimate of financial losses or identified how many accounts may have been compromised.

As a result, the scale of the incident remains unclear, including whether the reported activity was confined to a small number of wallets or extended to a broader group of users relying on the affected authentication services.

Keplr said it would publish verified findings and further instructions through its official X account as the investigation progresses. Until additional information becomes available, the company's guidance remains focused on preventing new deposits into potentially affected accounts and steering users away from unauthorized recovery services. The details to watch as the investigation advances are the identified cause, any figures on affected accounts or losses, and when Web3Auth restores its paused embedded wallet service.

Source: Hokanews, based on reporting by Ethan Collins for The Defiant.