Keplr Wallet has temporarily suspended Google and Apple login options after a security breach exposed users’ private keys through Web3Auth, a wallet authentication provider. The incident led to unauthorized transactions, with blockchain investigators tracing over $6 million in transfers from more than 44,000 wallets across Cosmos networks. Keplr co-founder Josh Lee estimated that roughly 20% of social-login accounts were potentially exposed, though only a fraction were exploited.
The breach originated in Web3Auth’s infrastructure, which allows users to access cryptocurrency wallets through existing online accounts. Lee clarified that Keplr’s own wallet code was not compromised, but the affected accounts relied on an external authentication service that experienced a security failure. Web3Auth acknowledged the issue and temporarily suspended its embedded wallet service while investigating the breach.
Blockchain intelligence firm Bitquery tracked approximately $6.01 million in assets across two collection addresses linked to the incident. The investigation identified 44,041 wallets across seven Cosmos networks, with Cosmos Hub accounting for about $3.5 million of the recorded assets. However, Web3Auth later disclosed that authorized recovery teams were moving assets through similar transaction paths, complicating efforts to distinguish protective transfers from malicious activity.
Web3Auth and its partners have initiated whitehat recovery operations to protect funds in vulnerable accounts. Keplr advised social-login users to move remaining liquid assets into secure recovery-phrase or hardware-wallet accounts and warned against unsolicited messages claiming to offer asset recovery. The company is working with Web3Auth to develop a method for customers to determine if their accounts were affected.