Keplr has paused Google and Apple social-login options after some users experienced unauthorized transactions, the wallet provider disclosed. The incident affects accounts created through social login, which rely on Web3Auth infrastructure to generate and access wallet keys. Keplr stated that accounts created with a recovery phrase or hardware wallet are not affected.
Social Login Pause and User Guidance
Web3Auth first paused its embedded-wallet service on November 6 and moved its Login Service into maintenance while investigating a security incident. Keplr disabled Google and Apple login the following day after confirming that some social-login accounts had transactions their owners did not authorize. The company advised users not to deposit new assets into affected accounts and to move remaining liquid tokens to a separate recovery-phrase or hardware wallet.
A private-key breach can expose Cosmos balances across multiple chains because Cosmos chains use one key across related addresses with different prefixes. Early tracking found activity on Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, and Babylon.
Initial Loss Estimate and Recovery Wallet Clarification
Bitquery initially traced at least $6.01 million to eight destinations, recording 44,041 drained wallets on seven linked chains and estimating total victims near 44,700. The research did not include unpriced tokens in its dollar total and logged a largest individual loss near $325,000. However, Web3Auth later said that flagged destinations belong to its recovery operation. On November 8, Web3Auth published verified recovery addresses across eight Cosmos chains, three additional Cosmos networks, and an EVM address covering eight chains. Keplr relayed the list and said the named addresses were not malicious or exploit addresses.
The overlap between Web3Auth's recovery wallets and addresses Bitquery had associated with the drain complicates the headline loss estimate. Web3Auth has not disclosed the value it secured, and neither company has provided a final loss reconciliation, return process, or technical postmortem.
Ongoing Uncertainty
Some accounts may appear empty because assets were moved during mitigation, Keplr said, adding that staked and locked assets require more time to secure. Users are warned not to trust direct messages, give up recovery phrases, or send funds to a claimed rescue address. The incident remains a confirmed security event with an unsettled financial tally, and the key distinction is that Web3Auth labels some transfer destinations as protective wallets while unauthorized activity affected social-login accounts.
