Keplr Google and Apple Login Wallets Hit by Key Breach

If you opened a Keplr wallet by tapping "Continue with Google" or "Sign in with Apple", stop and read this before you send it another token. A flaw at Web3Auth, the company that handles those social logins for Keplr, exposed private keys for some of those accounts. Some have already been drained. Others have been emptied on purpose, by the people trying to save them.

What happened

The first sign came late on Friday, November 6. At 21:13 UTC (02:43 IST on Saturday), Web3Auth posted on X that it was aware of a security issue affecting its services "used by some third parties" and had paused its embedded wallet service. It said it had found no evidence that MetaMask users were hit. Web3Auth has been owned by Consensys, the company behind MetaMask, since 2025.

About seven hours later, Keplr confirmed it had received reports of unauthorised transactions on some accounts created with Google or Apple login. It paused both sign-in options and said wallets made with a recovery phrase or a hardware wallet were not affected.

By Saturday evening the picture was clearer and worse. Web3Auth said it had identified a security issue in its own infrastructure affecting embedded wallets used by Keplr. Keplr then described it plainly as a "private key breach" for some social-login users.

Here is the twist. Web3Auth and its partners started what it calls whitehat recovery, moving funds out of wallets that were vulnerable but not yet hit, "utilizing the same path of the original attacker." So an empty balance doesn't automatically mean a thief got there first. On Sunday morning (around 11:53 IST), Web3Auth posted a list of verified recovery addresses for Cosmos Hub, Osmosis, Celestia, Injective, dYdX and several other chains, plus one EVM address. Keplr reposted the same list.

Neither company has said how many wallets were affected or how much was taken. Keplr co-founder Josh Lee gave an early estimate, reported by AltcoinReporter, that about 20% of Google and Apple login accounts were affected, with only a fraction of those actually exploited. Bigger loss figures doing the rounds on social media haven't been confirmed by either company. The Defiant has been following the updates too.

Why it matters

Social login is sold as the easy, safe way into crypto. No 24 words to write down, no seed phrase to lose. Keplr's own support docs explain that for these accounts Web3Auth generates the private key instead. The catch is that you're trusting a third company's servers with part of the job. When that company has a bad day, every app built on it does too, even if the wallet's own code is fine. Lee was clear that Keplr itself wasn't hacked. That's true, and it's no comfort if your balance is zero.

My take: what to do right now

1. Work out how you signed up. If you made your Keplr wallet with a recovery phrase or a Ledger, Keplr says you're not affected. If you used Google or Apple, assume you might be.
2. Don't send new funds to a social-login account. This includes exchange withdrawals and staking rewards you might redirect there.
3. Move whatever is still liquid to a brand-new wallet secured by a recovery phrase you write down on paper, or to a hardware wallet. Don't re-import the old social-login key into another app.
4. Check where missing funds went. Look up your address on a block explorer like Mintscan and compare the destination with Web3Auth's posted list. If it matches, your funds were moved for safekeeping, and both companies say a recovery path is coming. Staked and locked tokens will take longer.
5. Ignore anyone offering "recovery" in your DMs. This is where the second wave of losses usually comes from. Only trust @keplrwallet and @Web3Auth.

Using another app with a "sign in with Google" wallet? Check its official channels to see whether it runs on Web3Auth before you move money in or out.

My honest view: I like social login for small amounts and trying out an app. I don't like it for savings. This is the third crypto security story I've covered in a few weeks, after the Binance fake job interview theft and the Trezor implant warning. In each case the weak point wasn't the blockchain. It was a person or a service in between. If the money matters to you, hold your own seed phrase, offline.