Keplr Halts Google and Apple Logins After Private-Key Breach

Keplr shut down Google and Apple sign-ins on Nov. 6 after unauthorized transactions hit a slice of its user base. The root cause sits with Web3Auth, the key-management provider whose infrastructure secures wallets created through those social logins. A private-key breach, not a flaw in Keplr's own code, set off the response.

The numbers tell a messy story. At least 44,041 wallets across seven Cosmos chains, plus an estimated 7,603 on Injective, sent funds to two addresses after the incident began. After stripping out overlap, that works out to roughly 44,700 unique wallets. Web3Auth later confirmed those two addresses were recovery wallets it controlled.

Their combined balance stood at $6.01 million, priced at 10:27 a.m. ET on Nov. 7, with transfers counted through 10:38 a.m. the same day. That figure needs careful handling. It measures what flowed into the recovery addresses, not a confirmed theft total. Neither Keplr nor Web3Auth has said how many wallets the attacker actually drained, or what those losses amounted to.

What does this change for users?

Plenty, if you logged into Keplr with Google or Apple. Keplr's guidance to affected users is blunt: don't deposit funds into those accounts. Don't reimport the compromised wallets either. Instead, move whatever liquid assets remain into a wallet protected by a recovery phrase or a hardware device.

There's a clear line through the damage, though. Wallets secured with recovery phrases or hardware signing were never touched, according to Keplr. The blast radius stops at the social-login cohort whose private keys lived inside Web3Auth's infrastructure. That distinction matters for how the industry reads this incident. It's not a failure of self-custody itself. It's a failure of the convenience layer built on top of it.

Why social logins carry the risk here

Social-login wallets trade self-custody's friction for onboarding ease, and that trade has an operational cost when the middleman stumbles. Web3Auth acts as the distributed key infrastructure under those logins, which means a breach in its stack can expose private keys for every wallet that depends on it. Keplr's decision to pause Google and Apple sign-ins is the standard containment move: cut the exposed pathway first, count the damage second.

For the Cosmos ecosystem, the exposure spans seven chains plus Injective, which speaks to how far one provider's failure can travel across interconnected networks. Recovery operations appear underway, given the controlled movement of funds into the two identified addresses, but neither company has published a full accounting.

What comes next

Users with affected accounts face a simple triage: migrate to a phrase- or hardware-protected wallet before depositing anything else. For Keplr and Web3Auth, the open questions are harder. No disclosure yet on the true number of drained wallets. No confirmed loss figure. No timeline for restoring social logins.

Watch for a joint post-mortem with wallet-by-wallet loss estimates, and for a reopening date on Google and Apple sign-ins — that restart will be the real signal that Web3Auth believes its key infrastructure is clean again.