Keplr has switched off Google and Apple sign-in after some wallets created through those social logins sent out transactions their owners did not approve. The Cosmos wallet is investigating with Web3Auth, the Consensys-owned provider behind those logins, which had already paused its embedded wallet service over a security issue. Keplr co-founder Josh Lee said it was not a hack of Keplr’s code.
What Keplr and Web3Auth have said
Web3Auth spoke publicly first. Late on Friday it said it was aware of a security issue “affecting Web3Auth’s services used by some third parties,” that it had temporarily paused the embedded wallet service, and that an initial investigation found no evidence MetaMask users were affected. The same notice appeared on MetaMask’s developer forum on Saturday. It did not name the affected apps or describe the flaw.
More than seven hours later, at 04:38 UTC on Saturday, Keplr said it had received reports of unauthorized transactions on some accounts created with Google or Apple login, had flagged them to Web3Auth and was investigating with that team. Based on its initial assessment, wallets created with a recovery phrase or a hardware wallet are not affected.
For anyone who did sign up with Google or Apple, Keplr’s instructions were short: do not send new funds to the account, do not re-import or recreate it anywhere, and trust updates only from Keplr’s official account. Google and Apple login is paused for now. The wallet also told users to ignore direct messages or links offering “recovery,” a common tactic for scammers after wallet incidents.
How many accounts are involved
Neither company has published a count of affected wallets or a loss figure. The closest thing to a number came from Lee, who posted early findings a few hours after the wallet’s warning. He said the incident “originated at Web3Auth, a provider Keplr uses,” and that Keplr’s early estimate was that about 20% of accounts created with Google or Apple login were affected.
He was careful with the next part. “I don’t want to be overly optimistic, but it appears only a fraction of that 20% has actually been exploited, and the remaining accounts may be recoverable,” Lee wrote, adding that Keplr is working with the Web3Auth and MetaMask team on tracking and recovery. He did not say how recovery would work, and gave no timeline beyond promising more details soon.
Loss totals circulating on social media have not been confirmed by either company, and AltcoinReporter has not verified them. Some users have also claimed they lost funds without ever using social login. Keplr’s current position is that recovery-phrase and hardware-wallet accounts are safe, and nothing published by Keplr or Web3Auth so far points to a wider compromise.
Why social-login wallets are exposed differently
A Keplr account made with a Google login never had a 12- or 24-word recovery phrase. According to Keplr’s support pages, Web3Auth generates a private key for those accounts using distributed key generation, and the key is encrypted and stored on the user’s device. Users can export that key, but many who chose social login did so precisely to avoid handling one.
That design explains why the advice not to re-import matters. Keplr has not said what went wrong, so users cannot tell whether bringing the same key back into another app would leave it exposed again. For now, the only signal on a way out has come from Lee. Asked whether recoverable accounts would get a way to move funds to a new recovery phrase inside Keplr, Lee replied: “Yes. More details to follow but that is the plan.”
The incident also matters beyond Keplr. Consensys bought Web3Auth in June 2025, when its login tools were already used by thousands of decentralized applications, and has since folded the product into MetaMask Embedded Wallets, a toolkit for app developers. Web3Auth has said only that “some third parties” were affected. No other app has publicly confirmed losses so far.
Lee pointed to who is likely to be hurt most. People who created a wallet with a Google or Apple ID “are likely crypto beginners and the crypto curious,” he wrote. It comes in a rough week for wallet security: Gnosis Pay disclosed on Friday that a breach of its legacy card system exposed customer data.
What to watch next
Three things will shape how bad this gets. The first is Web3Auth’s root-cause explanation, which should show whether the issue sits in its key infrastructure or in how specific apps integrated it. The second is whether other wallets and apps built on the same service report unauthorized transactions. The third is the recovery mechanism Lee described for accounts that have been affected but not yet drained, and how quickly it can be offered before attackers reach them.
FAQ
Are Keplr wallets with a recovery phrase affected?
Keplr said its initial assessment is that accounts created with a recovery phrase or a hardware wallet are not affected. The reported unauthorized transactions involve accounts created through Google or Apple login.
What should Keplr social-login users do now?
Keplr told them not to send new funds to the account, not to re-import or recreate it anywhere, and to rely only on its official account for updates while ignoring anyone offering “recovery” by message or link.
Is MetaMask affected?
Web3Auth said its initial investigation found no evidence that MetaMask users were impacted. It has paused its embedded wallet service while it investigates.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
