Some users of the Keplr crypto wallet have had money stolen after a security flaw at Web3Auth, the company that runs its Google and Apple sign-in. Web3Auth has confirmed the flaw exposed private keys, and it has been moving funds out of other at-risk wallets to keep them safe.

Keplr is a popular wallet for the Cosmos family of blockchains. People who created their wallet by signing in with Google or Apple do not hold their own recovery phrase. Instead, Web3Auth generates and manages the private key on their behalf. That design is what the attacker was able to abuse.

How the attack unfolded

Web3Auth first disclosed a security issue in its infrastructure on Friday 6 November. By later that day, Keplr users were reporting unauthorised transactions from wallets created with Google or Apple login, and Keplr paused both sign-in methods while it investigated.

Keplr described the incident as a private key breach for some social-login users. A private key is the secret code that approves payments from a wallet, so anyone holding it can move the money. Neither company has said how the flaw worked, when the attacker first used it, or whether that route is now closed.

How much money is involved

Neither company has published a confirmed figure for the theft. Josh Lee, a co-founder of Chainapsis, the company behind Keplr, gave an early estimate that about 20 per cent of Google and Apple login accounts were affected, and that only a fraction of those appeared to have been exploited. Web3 security firm GoPlus said at least about $1 million had been stolen, without explaining how it reached that figure.

Blockchain data firm Bitquery counted at least $6.01 million moving from more than 44,000 wallets. Web3Auth later said those transfers were its own rescue operation, not theft. It used the same access route as the attacker to empty wallets that had not yet been hit, moving the funds into 12 recovery addresses across 11 Cosmos blockchains and eight Ethereum-style chains. The company says the rescued money is safe and that it is working with Keplr to return it to users, but it has not said how or when.

Who is affected and who is not

Wallets created with a written-down recovery phrase, or linked to a hardware wallet, are not affected, Keplr said. Only accounts set up through Google or Apple login are at risk. Web3Auth said the problem also affects its services used by some other companies, but Keplr is the only one it has named. It has paused its embedded wallet service, which other apps use to build wallets for their users, and its status page still showed its login service as down on Monday 9 November.

Web3Auth has been part of Consensys, the company behind the MetaMask wallet, since June 2025. Its initial investigation found no evidence that MetaMask users are affected.

What affected users should do

Keplr has told social-login users not to send new funds to the affected account, not to re-import or recreate the account anywhere, and to move any funds that are not staked or locked into an account that uses a recovery phrase or a hardware wallet. Staked and locked assets are taking longer to secure, and the company is working on a way for users to check whether their account was affected.

Users should trust updates only from the official accounts of Keplr and Web3Auth, and ignore direct messages or links offering recovery help, which are a common follow-up scam after a breach like this.