Keplr users who created their wallet with a Google or Apple login are reporting unauthorized transactions. The cause sits upstream. Web3Auth, the login provider behind Keplr’s social sign-in, has confirmed a security issue and paused its embedded wallet service. If your Keplr wallet runs on a recovery phrase or a hardware wallet, you are not affected. If you signed up with Google or Apple, read this now.
What happened to Keplr
Early on November 7, Keplr posted that some accounts created with Google or Apple login had seen transactions the owners never approved. The team flagged it to Web3Auth and both are investigating together.
Web3Auth had already gone public a few hours earlier. Its statement says a security issue affects Web3Auth services used by some third parties. As a result, the embedded wallet service is paused. Its login service status page shows maintenance due to a security incident.
Keplr’s initial assessment draws a clear line. Wallets created with a seed phrase or a hardware device are not affected. Wallets created through Google or Apple may be. Those social logins are switched off for now.
Neither company has shared how many accounts were drained or how much was taken. Nobody has explained the root cause yet either. We will update this post as verified details land.
Why social login wallets are the weak link
A Google login wallet feels like a normal wallet, but the key is not generated the way a seed phrase wallet works. Keplr’s own docs explain that social login accounts use Web3Auth to generate a private key through distributed key generation. In plain terms, pieces of your key live with a third party and are assembled when you log in. Your Google account is the door. Web3Auth holds part of the lock.
That design is convenient for beginners. It also means a problem at the provider becomes a problem for every wallet built on it. Web3Auth is owned by Consensys, which is why its statement mentions MetaMask. So far there is no evidence MetaMask users are impacted.
We have seen this movie before. Polymarket users were drained in late 2024 after logging in through Google. In December 2025 it happened again, this time traced to a different third-party authentication provider. Convenience logins keep turning into attack surface. If you trade on Polymarket, that history is worth remembering today.
What to do if you used Google or Apple login
Keplr’s instructions are short, so follow them to the letter.
Do not send new funds to the affected account. Anything you deposit could leave the same way the earlier transactions did.
Do not re-import or recreate the account anywhere. Keplr has not explained why, but a fair guess is that the investigation needs those accounts untouched and that recreating them may expose the key again.
Trust updates only from the official Keplr and Web3Auth accounts on X. Scammers are already circling. Any DM, reply or link that promises recovery is a drainer.
Keplr has not told users to move remaining funds out. Our opinion is the same as it was during the Binance hack: never sit and hope. If you still hold a balance in a social login Keplr account, moving it to a brand new wallet created with a seed phrase you control is the cautious call. Create that fresh wallet first, then transfer. Pay attention to every signing prompt while you do it.
Lessons for airdrop farmers
Cosmos airdrops made Keplr a standard tool for farmers, and it still earns its place in our list of the best wallets for airdrops. This incident does not change that. The wallet itself is open source and the seed phrase path held up. The lesson is about how you create wallets, not which brand you pick.
Never farm with a social login wallet. Create wallets from a seed phrase or, for anything meaningful, a hardware device. Our guide on whether Ledger is still safe covers the trade-offs. For a full lockdown routine, read our piece on crypto bunker mode.
If you already lost funds, the honest answer is that recovery is rare. We explain the realistic options in can stolen crypto be recovered. Report it to Keplr through official channels and document the transactions. Data breaches at big names like Coinbase have shown that refunds sometimes come, but only through the company, never through a stranger in your DMs. For perspective on how this one compares, our rundown of the biggest crypto hacks shows how often third-party infrastructure, not the wallet or exchange itself, was the entry point.
AirdropAlert tracks every major exploit and breach on our security tag, and our stay safe page collects the rules we follow ourselves.
Keep This Content Free
Hacks like this one are exactly why we publish security coverage within hours instead of days. Our team runs on exchange partnerships, so if you ever open an account, use our links for OKX or Bybit. It costs you nothing and keeps the warnings coming. While you are at it, the trading airdrops hub lists the current CEX bonuses and DEX points programs worth your volume.
Final Words
The Keplr incident is a Web3Auth incident. Seed phrase and hardware wallet users are fine. Google and Apple login users should stop depositing, avoid recreating the account, ignore every recovery offer, and in our view move any remaining balance to a wallet they fully control. We will keep this post updated as Keplr and Web3Auth release confirmed details.
FAQ
Is Keplr wallet hacked?
Keplr itself has not been hacked as far as the initial assessment shows. The issue sits with Web3Auth, the provider behind Keplr’s Google and Apple login. Wallets created with a seed phrase or hardware wallet are not affected.
Which Keplr users are affected?
Only accounts created with Google or Apple login may be affected. Those login options are paused while the investigation runs.
Should I move my funds out of Keplr?
Keplr has not asked users to move funds. If your wallet uses a social login and still holds a balance, moving it to a new seed phrase wallet is the cautious option in our view. Seed phrase and hardware users do not need to do anything.
Are MetaMask users affected by the Web3Auth issue?
Web3Auth says its initial investigation found no evidence that MetaMask users are impacted.
Can I get my stolen crypto back?
Recovery is rare. Report the loss to Keplr through official channels and never trust anyone offering recovery in DMs.
Credit: Source link
