“Sign in with Google” is the easiest way to get someone into crypto. This weekend it became the easiest way to get them out of it. Keplr, the most widely used wallet in the Cosmos ecosystem, switched off Google and Apple login after users reported unauthorised transactions — and the root cause turned out to be a flaw in Web3Auth, the key infrastructure behind those logins.
No seed phrase was phished and no app was hacked. The keys leaked from the service that was supposed to protect them.
Key facts
- On November 6, 2026, Web3Auth confirmed a security incident affecting third-party integrations and temporarily disabled its embedded wallet service.
- On November 7, 2026, Web3Auth attributed the incident to a vulnerability in its own infrastructure that leaked private keys of some Google and Apple login users.
- Keplr suspended Google and Apple login; co-founder Josh Lee estimated about 20% of social-login accounts could be affected, with only a fraction actually exploited.
- Initial loss estimates exceed $700,000, with some community estimates in the millions; neither Keplr nor Web3Auth has confirmed a total.
- Community investigators flagged outflows of INJ, OSMO and ATOM on Injective, Osmosis and Cosmos Hub.
- Keplr says wallets created with a recovery phrase or a hardware device show no sign of compromise.
What happened to Keplr wallets?
Keplr wallets created through Google or Apple login were drained because Web3Auth, the provider that generates and reconstructs their private keys, had a vulnerability that leaked those keys. Keplr says the flaw is not in its own app code. Wallets with their own seed phrase or a hardware device were not affected.
According to Crypto Adventure, users began reporting unexplained outflows on November 7, and community investigators traced movements of INJ, OSMO and ATOM. Web3Auth — owned by Consensys, the company behind MetaMask, since 2025 — said its initial investigation found no sign that MetaMask users were affected. It has not explained how attackers exploited the flaw and says it will share details once fund recovery is complete.
How social login wallets work
Social-login wallets have no seed phrase for the user to store. Web3Auth uses distributed key generation: the private key is split into shares held in different places and recombined when you log in with your Google or Apple account. That removes the “write down 24 words” step — and replaces it with trust in someone else’s infrastructure. When that infrastructure leaks, every account behind it is exposed at once.
No seed phrase to lose also means no seed phrase that is only yours.
Why do some balances look empty?
Not every empty wallet was robbed. Web3Auth and its partners moved funds out of at-risk wallets that had not yet been attacked, using the same route as the attacker, to get them out of reach first. As a result, some accounts show reduced or zero balances even though the coins were rescued, not stolen.
Web3Auth plans to publish a verified list of rescue addresses and asked users not to label unknown destinations as the attacker’s too quickly. Staked balances complicate things: unbonding periods on Cosmos chains mean locked coins cannot be moved instantly, which slows the rescue, KuCoin News reports. Keplr is building a tool to check whether an account is affected, but no date has been given — and as of November 7 there is no refund plan and no return date for social login.
What should Keplr users do now?
If you use a Keplr wallet created with Google or Apple login, stop sending funds or staking rewards to it and move freely available coins to a wallet with your own seed phrase or a hardware wallet, as Keplr advises. Do not re-import or recreate the social-login account while the investigation continues.
- Ignore unsolicited “recovery” offers — scammers follow every hack — and never type a key or seed phrase into any site or form.
- If a balance looks empty, check the destination on a block explorer against Web3Auth’s rescue list before assuming theft.
- Follow only Keplr’s official X account for updates.
What this means for swap users
Convenience layers sit between you and your keys, and each one is a dependency. The safest setup is still a wallet whose seed phrase only you control, ideally on a hardware device — our guide to crypto cold storage covers the options.
If you need to move coins out of an exposed wallet into another asset or chain, a non-custodial swap on SwapZilla sends the result straight to an address you choose, with no account to create. Set a refund address you control, and double-check the receiving address belongs to your new wallet — not to the one you are leaving.
Final thoughts
Keplr’s app was not hacked, and that is exactly the point. The weak link was a service most users never knew they relied on. Social login makes onboarding painless; it also concentrates risk in one place you cannot audit. Until Web3Auth explains what went wrong, treat any wallet without a seed phrase you hold as a hot wallet someone else can touch.