Keplr, a Cosmos wallet provider, suspended Google and Apple logins on Nov. 7 after a security vulnerability at third-party authentication provider Web3Auth exposed private keys, triggering unauthorized transactions across multiple Cosmos networks. Blockchain investigators traced more than $6 million in transfers, though recovery operations complicate the actual theft total.
Web3Auth Vulnerability Exposes Social Login Accounts
The incident began on Friday, Nov. 6, when Web3Auth disclosed a security issue affecting infrastructure used by third-party services. By early Saturday, Keplr reported unauthorized transactions involving accounts created through Google and Apple authentication, prompting the wallet provider to disable both login methods.
Josh Lee, co-founder of Chainapsis, the company behind Keplr, clarified that the vulnerability originated with Web3Auth rather than Keplr’s own software. Early estimates suggested approximately 20% of social-login accounts were affected, although only a fraction had reportedly been exploited.
The distinction matters because Keplr’s social-login feature relies on third-party key infrastructure rather than conventional user-controlled recovery phrases. That convenience simplifies cryptocurrency onboarding but creates dependencies absent from traditional hardware-wallet and seed-phrase arrangements.
Over $6 Million in Transfers Across Cosmos Networks
Blockchain analytics company Bitquery examined transactions spanning Nov. 6-7, identifying extensive wallet-draining activity across Cosmos Hub, Osmosis, Celestia, Akash, Noble, Dydx, Babylon, and Injective.
Its investigation estimated that collector addresses received assets worth at least $6.01 million, based on valuations recorded Nov. 7. Cosmos Hub represented approximately $3.50 million, followed by Osmosis at $1.04 million and Injective at $615,000.
Bitquery’s analysis counted approximately 44,700 distinct private keys involved in the activity, with 86% of affected wallets on seven linked networks experiencing transfers after Keplr’s initial warning. Median wallet losses were just $1.34, although the largest individual transfer approached $325,000.
Investigators also documented approximately 1.96 million staked ATOM moving without the customary 21-day unbonding period. The transactions employed liquid staking mechanisms, converting positions into transferable share tokens while redirecting roughly $251,000 in staking rewards.
Recovery Operations Complicate Theft Estimate
Subsequent disclosures introduced an important complication. Keplr and Web3Auth confirmed that white-hat recovery operations were using the exposed access path to move vulnerable assets into protective custody.
On Sunday, Nov. 8, Keplr identified recovery addresses that overlapped with several collector wallets examined by Bitquery. Consequently, the $6.01 million represents observed transfers, not a verified accounting of irrecoverable theft.
Web3Auth maintains that funds transferred through its protective operations remain secure. Keplr cautioned that some affected users might encounter unexpectedly empty balances because their assets had been relocated for safekeeping.
The companies have not disclosed the vulnerability’s precise technical cause, established a definitive loss figure, or announced a comprehensive reimbursement schedule.
User Guidance
Users who created accounts through Google or Apple should avoid depositing additional assets, transfer remaining liquid holdings into newly secured wallets, and disregard unsolicited recovery offers. Staked assets may require additional processing.
Recovery-phrase and hardware-wallet accounts remain unaffected, while Web3Auth and Keplr work to secure vulnerable social-login wallets.
The incident exposes an uncomfortable contradiction in cryptocurrency wallet design. Simplifying private-key management can make blockchain applications more accessible, but outsourcing authentication introduces another potential point of failure. Until protective transfers are reconciled with malicious withdrawals, the industry’s latest multimillion-dollar security scare remains as much an accounting mystery as a technical emergency.
