Keplr Wallet has suspended Google and Apple login functionality after users reported unauthorized cryptocurrency transfers, with early estimates suggesting that roughly 20% of accounts created through social authentication may be vulnerable.

The November 7 incident has affected wallets across the Cosmos ecosystem, with community investigators reporting stolen assets involving Injective, Osmosis and Cosmos Hub. Initial loss estimates exceeded $700,000, although subsequent independent tracking indicates substantially larger outflows. Keplr has not confirmed an official loss total.

The security issue originated with Web3Auth, the third-party authentication provider that powers Keplr's social login functionality. Both companies are investigating the compromise, and Keplr has warned affected users against depositing additional assets or attempting to recreate their wallets.

Co-Founder Estimates 20% of Social-Login Accounts May Be Exposed

Keplr confirmed the unauthorized transactions involving Google and Apple accounts in an official statement on X, distinguishing those wallets from accounts created through conventional recovery phrases or hardware devices. The company said its preliminary investigation found no evidence that those other wallet types had been compromised through the Web3Auth incident.

Chainapsis co-founder Josh Lee, whose company develops Keplr, provided additional details, estimating that approximately 20% of social-login accounts could be affected. He stressed, however, that only a fraction of the potentially vulnerable accounts appeared to have been exploited, leaving open the possibility of restoring access to the others. Lee also clarified that the incident did not stem from a vulnerability in Keplr's own application code.

Keplr's social authentication system relies on Web3Auth's distributed key generation infrastructure, a cryptographic design that splits key material across multiple parties so that no single device or server ever holds a complete private key. It allows users to create cryptocurrency wallets through existing Google or Apple accounts instead of manually managing recovery phrases, an approach long promoted as easing onboarding for users new to self-custody. The wallet's security architecture generates private keys through Web3Auth and stores encrypted credentials locally. The convenience of that design, however, ties wallet security to the infrastructure of an outside provider. The exact mechanism that enabled the unauthorized transactions has not been disclosed.

Web3Auth Suspends Services as Loss Estimates Rise

Web3Auth acknowledged a security incident affecting third-party integrations on November 6 and temporarily disabled its embedded wallet service. The company subsequently placed its login infrastructure into maintenance, confirming that precautionary measures were underway. Web3Auth, which was acquired by MetaMask developer Consensys in 2025, said its initial investigation found no evidence that MetaMask users were affected.

Meanwhile, independent community investigators have traced suspicious movements involving ATOM, OSMO and INJ tokens, with some estimates now reaching several million dollars. Neither Keplr nor Web3Auth has verified those figures or disclosed the number of affected users.

The episode follows a string of recent attacks involving external cryptocurrency infrastructure. On October 29, Polymarket suffered a $2.7 million wallet-draining exploit after malicious JavaScript entered its trading interface through a compromised monitoring provider. Separately, BTCPay Server warned operators about unauthorized hot wallet withdrawals linked to vulnerable software installations. Read together, the incidents underscore how attackers have increasingly targeted the third-party infrastructure that crypto products depend on — monitoring tools, payment software, authentication services — rather than the applications' core code.

Keplr has instructed users who created wallets through Google or Apple authentication not to send additional funds to those accounts or re-import them into other applications while the investigation continues. The team has also cautioned against unsolicited recovery assistance, fraudulent support messages and suspicious links claiming to restore stolen funds, with further guidance available in its help center.

No reimbursement plan or timeline for restoring social login functionality has been announced. The investigation is ongoing as Keplr and Web3Auth work to identify affected accounts, determine the attack method and assess potential recovery options. For now, observers are watching for three things neither company has yet provided: a confirmed attack method, verified loss figures and a timeline for bringing social logins back online.

This article originally appeared on Crypto Adventure.