Some Keplr crypto wallets created with Google or Apple sign-in lost money after an attacker used a flaw in Web3Auth, the login provider behind that sign-in flow. Web3Auth and Keplr both said late last week that the issue touched wallets inside the Keplr app, while some other wallets were emptied by Web3Auth and moved into recovery wallets before an attacker could reach them.
Affected Wallets And Recovery Moves
Wallets created with a recovery phrase, meaning a backup list of 12 or 24 words, were not affected, and hardware wallets were also outside the incident. Keplr paused Google and Apple sign-in while it investigates. It also told users with accounts created through those login methods not to add new funds, not to re-import or recreate the account anywhere, and to move any funds that are neither staked nor locked to a wallet that uses a recovery phrase or a hardware wallet.
The wallet maker said staked and locked assets are taking longer to secure. It is also working with Web3Auth on a way for users to check whether their account was affected. Web3Auth published a recovery address list so people can distinguish its own transfers from transfers that may be malicious, and it warned users not to assume an unfamiliar destination address is connected to the attacker.
What Web3Auth And Keplr Said Happened
Web3Auth said a security issue in its own infrastructure affected certain wallets it provides inside Keplr. Keplr said the flaw led to a private key breach for some users who signed in with Google or Apple. A private key is the secret code that authorizes payments from a wallet, so whoever has it can move the funds.
Neither company has said how the flaw worked, when the attacker first used it, or whether that route is now closed. Josh Lee, a Keplr co-founder, said in his initial findings that about 20% of Google and Apple login accounts were affected and that only a fraction of those appeared to have been exploited. GoPlus, a Web3 security company, said in a security alert that at least about $1 million had been stolen, though it did not explain how it arrived at that figure.
How Much Money Moved
The login provider said the rescued money went into secure recovery wallets on 11 blockchains in the Cosmos family and eight Ethereum-style chains. Bitquery, a blockchain data firm, counted at least $6.01 million moving from more than 44,000 wallets into those recovery wallets by late last week.
The firm first described the transfers as theft, then issued a corrected analysis that treated them as rescue transfers. It also said it could not verify who controls the recovery wallets. Its data showed that the first transfer arrived 21 minutes before Web3Auth’s first public notice, and that 86% of the wallets were emptied after Keplr warned users. Web3Auth said the moved funds are safe and that it is working with Keplr to return them to users, but it has not said how or when.
Impact Beyond Keplr
Web3Auth said the issue affects its services used by some other companies, though Keplr is the only one it has named. It paused its embedded wallet service, which other apps use to build wallets for their users, and its status page still shows its login service as down today. Consensys, the company behind MetaMask, bought Web3Auth in June 2025, and its acquisition announcement said the deal would let MetaMask users create and recover wallets with social logins.
Web3Auth said its initial investigation found “no evidence that MetaMask users are impacted.”
Licensed under CC BY-ND 4.0 International