TLDR
- Keplr paused Google and Apple logins after users reported unauthorized transactions.
- The issue started at Web3Auth, the third-party provider behind social login.
- An early estimate says about 20% of social-login accounts may be affected.
- Recovery phrase and hardware wallet accounts are not affected.
- Neither company has shared total losses, the root cause or a fix timeline.
Keplr, a non-custodial crypto wallet widely used in the Cosmos ecosystem, has paused Google and Apple social logins. Some users reported unauthorized transactions on accounts created with those methods. The company links the problem to Web3Auth, the third-party provider that powers the feature.
⚠️ALERT: Crypto wallets created with Google or Apple logins are being hit by unauthorized transactions.
Keplr, the main wallet of the Cosmos ecosystem, paused both login options after users reported the thefts.
The incident originated at Web3Auth, the login service owned by… pic.twitter.com/wYn5BFaxCg
— Coin Bureau (@coinbureau) November 7, 2026
Keplr says wallets set up with a recovery phrase or a hardware wallet are not affected. In a non-custodial wallet, users hold the private keys that approve transactions. Cosmos is a network of independent blockchains that talk to each other through a protocol called IBC.
How the Incident Unfolded
Web3Auth first flagged the issue in a post on X at about 21:13 UTC on November 6, 2026. It said a security issue was affecting services used by some third parties. It also paused its embedded wallet service, which lets people sign in and transact inside an app without a separate wallet extension.
Web3Auth said an early review found no evidence that MetaMask users were hurt. Its status page lists the Login Service as under maintenance because of a security incident. The company said it would share confirmed details once they were available.
Keplr posted its own statement at about 04:38 UTC on November 7. It said it had received reports of unauthorized transactions on some accounts made with Google or Apple login. The wallet said it passed those reports to Web3Auth and has worked with the team since.
Josh Lee, co-founder of Chainapsis, the company behind Keplr, shared early findings at about 08:29 UTC. He said the incident was not a hack of Keplr’s own code and began at Web3Auth. He said recovery phrase and hardware wallet accounts remain safe.
Which Accounts Are at Risk
Lee said the problem seems to hit some, but not all, Google and Apple login accounts. An early estimate puts the share at about 20%. He said only a fraction of those accounts appear fully exploited so far, and the rest may still be recoverable.
Social login lets users create a wallet with an existing Google or Apple account. It replaces the recovery phrase, a list of words that can rebuild a wallet on any device. Keplr’s support pages say Google login keys come from Web3Auth through distributed key generation, which splits key creation across several parties.
Keplr asked holders of possibly affected accounts to stop sending new funds to them. It also asked users not to re-import or recreate those accounts in another wallet or app. Users should trust updates only from Keplr’s official X account.
The company also told users to ignore direct messages or links that offer recovery help. Scammers often pose as support staff after wallet incidents to collect recovery phrases. Hardware wallet maker NGRAVE gave similar advice after a recent phishing attack.
Keplr is working with Web3Auth and MetaMask to track the affected accounts and try to recover funds. Consensys, the software firm behind MetaMask, bought Web3Auth on June 2, 2025. Lee said the situation is hard because many social-login users are new to crypto.
What Is Still Unknown
Neither company has published the number of affected accounts or the value of assets involved. They have not named the chains or tokens hit, the root cause or a date for a fix. The 20% figure is an early estimate and not a confirmed count.
Some users on X claim losses beyond Keplr’s stated scope, including older accounts and staked assets. These claims are unofficial, and The Crypto Times could not verify them. They also conflict with parts of Keplr’s assessment.
Other wallet security warnings came earlier in the week. BTCPay Server told users to shut down their instances after reports of hot wallet drains. CertiK also warned that the DarkSword iOS exploit can target crypto wallets on unpatched iPhones.
As of about 11:30 UTC on November 7, Web3Auth’s embedded wallet service was still paused. Keplr had not restored Google or Apple login. Both companies said they would share verified details when available.
