Keplr Suspends Google and Apple Wallet Logins After Unauthorized Transaction Reports

Keplr, the crypto wallet provider, has paused sign-in through Google and Apple accounts following user reports of unauthorized transactions, and has told customers who access their wallets via social login to stop sending funds to those accounts until further notice.

The suspension covers both login routes. According to Keplr's initial assessment, accounts protected by recovery phrases and hardware wallets are unaffected by the reported activity. The company describes that assessment as its first review of the incident, and it has not yet published a fuller technical explanation of the failure mode.

What does this change for wallet users?

The practical split is clean, and it matters for how practitioners triage exposure:

• Social-login users — those whose wallet access is tied to an existing Google or Apple account — should make no new deposits while the sign-in pause remains active. Keplr's warning singles out this route specifically.
• Recovery-phrase users — accounts where the user controls the seed phrase directly — fall outside the warning, per the initial assessment.
• Hardware-wallet users — accounts accessed through a separate signing device — are likewise unaffected, per the same assessment.

The distinction is architectural, not incidental. Social login delegates the authentication layer to a third-party identity provider: the wallet's security boundary becomes the Google or Apple account rather than a user-held secret. Recovery phrases and hardware wallets keep the key material, or its authorization, in the user's hands through a separate access path. An incident that appears confined to the social-login route is therefore consistent with a problem at the delegated-authentication layer rather than in key generation or on-chain signing itself — though Keplr has not yet confirmed the root cause, and its assessment is explicitly preliminary.

Why the operational response matters

Suspending both sign-in options at once, rather than only the route associated with reports, is a containment decision. It trades user friction for a wider blast-radius reduction while the investigation runs: if the company cannot yet confirm which authentication path failed, disabling both removes the uncertain one alongside the suspect one.

The instruction to stop sending funds is the more consequential half of the response. New deposits into social-login accounts create fresh exposure during an active incident window; halting inbound transfers freezes the amount at risk while Keplr determines what occurred. Users with funds already in social-login accounts have not been told those funds are lost — only that the account route is under review and should not receive new value.

For practitioners, the episode is a working illustration of a custody distinction that has become sharper as wallets add conventional login flows. A wallet that supports OAuth-style access inherits the operational risk profile of the identity provider and the integration around it, in addition to its own. The unaffected status of seed-phrase and hardware accounts in Keplr's initial review is the practical argument for that separation showing up in a live incident.

Keplr has not announced a timeline for restoring Google and Apple sign-in. Users reliant on social login should treat the pause as open-ended, withhold new deposits, and watch for the company's follow-up findings before resuming normal funding of those accounts.