Blockchain analytics firm Bitquery has traced at least $6.01 million in losses from Keplr wallets over November 6-7, 2026, to exposed private keys associated with accounts created using Google or Apple logins. The findings point to the convenient social-login option, rather than the wallet’s traditional setup method, as the vulnerable entry point.
How the drain unfolded
Bitquery identified approximately 44,700 distinct wallets touched by unauthorized transactions. Its breakdown counted 44,041 wallets on Cosmos ecosystem chains and 7,603 on Injective. The Cosmos Hub accounted for the largest share of losses, with about $3.5 million taken from that chain alone.
A significant portion of the Cosmos Hub losses involved staked assets. Roughly 1.96 million staked ATOM were moved out without going through the usual 21-day unbonding period.
Timing data shows that 86% of drained funds on linked networks were moved in transactions that occurred after Keplr issued its initial warning on November 7, 2026. In other words, most of the money left after users had already been alerted.
Where the blame is landing
Keplr, the wallet’s developer, attributed the breach to a security vulnerability in Web3Auth, the third-party service that manages the social login flow and handles wallet keys for those accounts. Web3Auth confirmed that a vulnerability in its infrastructure exposed the private keys of some third-party users. The company said it took protective measures, which coincided with the attacker’s transaction patterns.
Keplr co-founder Josh Lee indicated that the breach affected an estimated 20% of accounts created using social logins, adding that only a fraction of those had been fully exploited so far. Keplr suspended Google and Apple logins immediately and started recovery efforts for affected accounts.
As of November 8, 2026, neither Keplr nor Web3Auth had disclosed the exact technical cause of the breach, a precise total for losses, or the number of impacted accounts. How much money can be recovered also remains undisclosed.
Why social logins and recovery phrases are different
A crypto wallet is ultimately controlled by a private key. Whoever holds that key can move the funds. The classic way to back up that key is a recovery phrase, usually a string of 12 or 24 words that the user writes down and stores securely, placing full responsibility on the individual.
Social logins exist because recovery phrases can be a difficult user experience for newcomers. Services like Web3Auth let users sign in with familiar Google or Apple accounts instead. The tradeoff is that key management leans on outside infrastructure. When that infrastructure has a flaw, the keys it helps manage can be exposed, which is what Web3Auth says happened to some users.
The reported damage in this incident clusters around accounts created through Google and Apple logins. Users who set up Keplr with a traditional recovery phrase were not the focus of the reported key exposure.
What this means for users and the Cosmos ecosystem
For affected users, the immediate priority is clear: anyone with a Keplr account created through Google or Apple should treat it as potentially exposed and follow Keplr’s recovery guidance.
The 86% post-warning figure is particularly notable. A large share of the losses happened after users were alerted, suggesting that how quickly wallet providers can reach their users during an active incident may matter as much as the fix itself.
Several open questions remain. Keplr and Web3Auth still need to explain the exact technical cause, confirm the final loss total and number of affected accounts, and spell out how much users can expect to get back. Until those answers arrive, the $6.01 million traced by Bitquery is a floor rather than a final tally.
