Keplr Pauses Google, Apple Logins Amid Web3Auth Probe

By Tom Whitfield

Keplr paused two sign-in methods—Google and Apple—after receiving reports of unauthorized transactions in some wallets opened through the two social-login methods, according to the Cosmos-focused wallet provider.

The suspension covers both login options while Keplr reviews the reports. Keplr works with Web3Auth, which provides the embedded-wallet infrastructure used for the affected accounts, and the companies are working together on the incident.

Web3Auth announced a temporary suspension of its embedded wallet service after identifying a security issue involving some third-party services. The action places the infrastructure provider’s response alongside Keplr’s account-level review as both companies examine a possible exposure through social login.

What prompted the pause?

Keplr’s reports concerned unauthorized transactions in accounts created through Google or Apple sign-in. The company did not characterize the issue as a failed login alone, and the available disclosures did not explain how the transactions could have occurred.

That mechanism remains central to the scope of the incident. Web3Auth’s preliminary review found “no evidence that MetaMask users were affected,” according to the infrastructure provider. Keplr’s own initial assessment drew a different boundary: accounts created with recovery phrases or hardware wallets were unaffected, while accounts opened through Google or Apple could be affected.

The distinction leaves two provisional categories. Social-login accounts face an active review, while recovery-phrase and hardware-wallet accounts sit outside Keplr’s initial impact assessment. Neither finding is a final audit, and Web3Auth said only that its MetaMask review found no evidence of impact.

Keplr’s initial assessment points to possible exposure through social login. That framing identifies the affected access path without establishing the transaction mechanism, and the companies have not published a technical explanation for the unauthorized transactions.

What remains undisclosed?

Neither company disclosed the number of affected accounts or the amount of losses. They also did not identify the chains or tokens involved, leaving three core measures of exposure unavailable: user count, financial loss and affected-chain or token exposure.

Those omissions constrain any assessment of the incident’s scale. Without them, Keplr users cannot determine from the published disclosures how broad the issue is or whether the reported transactions involve a common set of assets. The information did not include a transaction hash, wallet address or on-chain record tying the reports to specific activity.

What are affected users being told?

Keplr told potentially affected users not to “add funds or import or recreate their accounts.” The instruction bars new funding, imports and account recreation while the company confirms what happened and how users should respond.

Keplr said it would share next steps through its official account after confirming details. The company has not announced a restoration time in the disclosed information, leaving users to wait for a verified communication before adding funds or recreating accounts.

What happens next?

The next material disclosure should identify the size of the incident and clarify whether the issue extends beyond social-login wallet creation. Keplr’s promised update will also need to address when Google and Apple sign-in can resume, because the current suspension changes access through two routes into its wallet service.

Web3Auth’s temporary suspension adds another constraint on that timetable. Any restoration of the affected embedded-wallet service would change the availability of the infrastructure behind Keplr’s social-login flow, although neither company has set a firm reopening deadline.