Bitquery Traces $6.01M Keplr Wallet Drain to Web3Auth Key Exposure

At least $6.01 million left Keplr wallets between November 6 and 7, 2026, and blockchain analytics firm Bitquery has traced the losses to exposed private keys on accounts created through Google and Apple social logins. Keplr attributed the breach to a security vulnerability in Web3Auth, the third-party provider that manages keys for those accounts, and Web3Auth has confirmed the exposure.

The numbers are granular. Bitquery's on-chain analysis identified roughly 44,700 distinct wallets touched by unauthorized transactions: 44,041 on Cosmos ecosystem chains and 7,603 on Injective. Cosmos Hub alone accounted for approximately $3.5 million of the total. A portion of that involved staked assets — about 1.96 million staked ATOM moved out without passing through the network's standard 21-day unbonding period.

What does the timing reveal?

The most damaging detail in Bitquery's dataset is chronological. The firm traced 86% of drained funds on linked networks to transactions executed after Keplr issued its initial warning on November 7, 2026. Most of the money left after users had been told something was wrong.

That figure has operational consequences beyond this incident. It suggests that how quickly a wallet provider can actually reach its users during an active attack — and get them to act — may matter as much as patching the underlying flaw.

Where does responsibility sit?

Keplr blames Web3Auth. The wallet developer said the breach stemmed from a vulnerability in the third-party service that handles the social login flow and key management for those accounts.

Web3Auth confirmed that a vulnerability in its infrastructure exposed the private keys of some third-party users. The company said it took protective measures, and that those measures coincided with the attacker's transaction patterns — implying the attacker raced against the shutdown.

Keplr co-founder Josh Lee indicated the breach affected an estimated 20% of accounts created using social logins, though only a fraction of those had been fully exploited so far. Keplr suspended Google and Apple logins immediately and began recovery efforts for affected accounts.

Why social logins carry different risk?

Every crypto wallet reduces to a private key. Whoever holds the key moves the funds. The traditional backup is a 12- or 24-word recovery phrase, stored by the user alone.

Social logins exist because seed phrases are a poor experience for newcomers. Web3Auth lets users sign in with familiar Google or Apple accounts instead. The tradeoff is that key management runs through outside infrastructure, and when that infrastructure has a flaw, the keys it manages can be exposed — which is what Web3Auth says happened.

The damage in this incident clusters entirely around social-login accounts. Users who set up Keplr with a traditional recovery phrase were not part of the reported key exposure, according to the reporting.

What happens next?

As of November 8, 2026, neither Keplr nor Web3Auth had disclosed the exact technical cause of the breach. Neither had published a precise total for losses, a confirmed count of impacted accounts, or a recovery figure for affected users.

For holders, the immediate step is straightforward: any Keplr account created through Google or Apple should be treated as potentially exposed, and users should follow Keplr's recovery guidance.

Until Keplr and Web3Auth explain the root cause and publish final figures, the $6.01 million traced by Bitquery stands as a floor, not a final tally.