Bitquery traces $6.01M theft to Keplr social-login wallets

By Tom Whitfield

Bitquery traced at least $6.01 million in unauthorized transfers from roughly 44,700 Keplr wallets, according to its transaction analysis. Keplr immediately suspended Google and Apple logins after Web3Auth confirmed that a vulnerability in its infrastructure exposed private keys for some third-party users.

Within the broader count, Bitquery tallied 44,041 wallets on Cosmos ecosystem chains and 7,603 on Injective. Cosmos Hub accounted for approximately $3.5 million of the losses. Attackers moved about 1.96 million staked ATOM out without the usual 21-day unbonding period.

What happened after Keplr's first warning?

Keplr issued its initial warning on November 7, 2026. Bitquery traced 86% of drained funds on linked networks to transactions completed after that alert. The finding suggests that reaching users quickly may matter as much as repairing the vulnerable infrastructure.

That concentration makes the reach and timing of incident warnings an operational concern for wallet providers. The 86% metric applies to the value of drained funds on linked networks, not the number of exposed accounts or wallets.

What did Keplr and Web3Auth disclose?\n

Keplr attributed the breach to a security vulnerability in Web3Auth, the third-party service that manages the social-login flow and handles wallet keys for those accounts. Web3Auth confirmed that a vulnerability in its infrastructure exposed private keys for some third-party users.

The company said the protective measures it took coincided with the attacker's transaction patterns. Keplr co-founder Josh Lee said the breach affected an estimated 20% of accounts created using social logins, adding that attackers had fully exploited only a fraction of those accounts so far.

Keplr suspended Google and Apple logins immediately and started recovery efforts for affected accounts. As of November 8, 2026, neither Keplr nor Web3Auth had specified the exact technical cause, a precise loss total or the number of impacted accounts. Neither company had disclosed how much users could recover.

Why do social logins differ from recovery phrases?

A crypto wallet is controlled by a private key, and whoever holds that key can move the funds. The conventional backup is a recovery phrase, usually 12 or 24 words that the user records and stores safely. That model leaves responsibility for key custody with the wallet holder.

Social logins offer a simpler path for newcomers by letting them sign in with familiar Google or Apple accounts. Services such as Web3Auth then rely on outside infrastructure for key management. The distinction does not remove the private-key requirement; it changes who manages the infrastructure around that key.

The reported damage clustered around accounts created through those social logins. The reported key exposure did not focus on Keplr accounts set up with a traditional recovery phrase.

What should affected users do now?\n

Anyone with a Keplr account created through Google or Apple should treat it as potentially exposed and follow Keplr's recovery guidance. The 86% post-warning share leaves notification speed and user reach as immediate operational tests alongside the infrastructure repair.

Keplr and Web3Auth still need to explain the exact technical cause, confirm the final loss total and number of affected accounts, and specify how much users can recover. Until those answers arrive, $6.01 million remains a floor rather than a final tally, and notification speed remains the immediate test for social-login wallet providers.