Keplr Pauses Social Logins After $6.01 Million in Transfers

At least $6.01 million in assets moved to two receiving addresses across seven Cosmos networks and Injective after unauthorized transactions hit wallets using Keplr’s social logins, according to the reported transfer tally. The tally counted the movement through 10:38 a.m. ET on Nov. 7 (15:38 UTC).

Keplr paused Google and Apple sign-ins late Nov. 6 after detecting unauthorized transactions in some wallets tied to those login methods, the wallet provider said. Co-founder Josh Lee said the incident “originated at Web3Auth,” the embedded-wallet provider used for those sign-ins.

What did Keplr suspend?

Keplr’s response covered the Google and Apple social sign-ins that used Web3Auth. It did not extend to accounts using recovery phrases or hardware wallets. Keplr said those accounts “were unaffected,” narrowing the reported disruption to the social-login flow rather than all wallets served by the provider.

The disclosure gave no restoration date for the sign-ins and no verified count of affected people. The estimate covered about 44,700 unique wallet keys, which is a technical measure rather than a confirmed number of users. The disclosed estimate therefore cannot establish how many people controlled the affected keys.

How was the $6.01 million measured?

The estimate combined a defined set of transfers with a single valuation snapshot:

• At least $6.01 million in assets reached two receiving addresses.
• The transfers spanned seven Cosmos networks and Injective.
• Counting continued through 10:38 a.m. ET Nov. 7 (15:38 UTC).
• Dollar values used spot prices at 10:27 a.m. ET (15:27 UTC).
• The scope covered about 44,700 unique wallet keys.

The 11-minute gap between the transfer cutoff and pricing snapshot makes the dollar figure a point-in-time valuation, not a final realizable value. It also does not establish that every asset sent to the addresses was stolen or that all of those assets remained there.

In the disclosed material, the seven Cosmos networks were not named and the assets were not itemized token by token. The aggregate figure therefore measures transfer scale, not the composition of the transferred assets or the amount ultimately returned to users.

On Nov. 8, Keplr and Web3Auth identified the two addresses as recovery wallets and published verified recovery addresses. The designation clarified the addresses’ stated purpose, but it did not convert the transfer tally into a confirmed theft amount. It also did not establish that the assets had reached users; neither company disclosed a final return total.

How much was stolen and recovered?

Neither company disclosed how much the original attacker stole or how much was ultimately returned to users. The $6.01 million therefore measures assets that moved to two addresses later designated as recovery wallets; it is not a verified loss or recovery total.

A recovery transfer can enter a recovery wallet without establishing that the same value was permanently lost. Conversely, a later recovery does not retroactively turn every transfer into theft.

For users, the access disruption remains tied to Google and Apple social logins. Accounts using recovery phrases or hardware wallets remain outside the affected route, according to Keplr.

The split limits disruption for those other wallets, but customers who depend on embedded wallets cannot use the suspended sign-in path. Keplr and Web3Auth still lack a reconciled figure for user losses and returned funds.

With no court deadline or law-enforcement window disclosed, the next material checkpoint is operational: Keplr’s timing for restoring Google and Apple sign-ins and a reconciliation of the $6.01 million into verified losses and returned funds.