Keplr has confirmed that a vulnerability in Web3Auth’s infrastructure exposed private-key material used by some wallets created through Google and Apple sign-in, after an on-chain investigation traced at least $6.01 million in assets to two collection addresses. The incident affected social-login accounts; Keplr says wallets created with recovery phrases or hardware devices were not affected.
Bitquery’s November 7 investigation counted 44,041 wallets across seven Cosmos chains and another 7,603 drained addresses on Injective. Those figures overlap because one private key can control addresses on several networks. After accounting for duplication, Bitquery estimated about 44,700 distinct wallets had been affected.
The first signs were not a large outflow, but a string of small transfers that would be easy to miss in a busy chain. Bitquery traced the first test sweep to 20:52 UTC on November 6, when ten Cosmos Hub wallets sent tiny amounts to the same destination. Keplr recieved reports and publicly warned users at 04:38 UTC on November 7, after Web3Auth had already announced a security issue affecting third-party services.
Keplr initially told potentially affected users not to deposit new funds or re-import their accounts, and paused Google and Apple sign-in. Co-founder Josh Lee separately estimated that about 20% of social-login accounts could be affected, while saying only a fraction of that group appeared to have been exploited. That was an early estimate of account exposure, not a confirmed count of wallets drained or a claim that 20% of all Keplr users lost funds.
A provider-side breach, not a Keplr code exploit
Keplr later said a Web3Auth infrastructure vulnerability had led to a private-key breach affecting some users who signed in through Google or Apple. The company said the incident did not originate in Keplr’s own code. There is no public evidence that Google or Apple account systems themselves were compromised.
Web3Auth first described a security issue affecting services used by third parties and temporarily paused its embedded-wallet service. It later seperately identified certain embedded wallets used by Keplr as affected, while saying its initial investigation found no evidence that MetaMask users were impacted. Web3Auth has not published a technical post-mortem explaining how the private keys were exposed or a full list of other applications that may have relied on the affected infrastructure.
Pausing sign-in could stop users from creating or restoring wallets through the affected route, but it could not invalidate private keys already exposed to an attacker. For users watching their balances fall, the pause was a shield that did not cover much. Bitquery found that 86% of victims counted across the seven same-key Cosmos chains were drained after Keplr’s 04:38 UTC warning. The transactions showed the wallets’ signing authority being used, but not exactly how that authority had been obtained. The warning was out, but the keys had not been pulled back.
The distinction between a compromised software layer and a flaw in a wallet’s underlying protocol has appeared in other incidents. Dave Finances previously examined how a compromised wallet software layer can expose private keys, although the Keplr incident involves Web3Auth’s embedded-wallet infrastructure rather than a browser extension.
On-chain losses spread across Cosmos networks
Bitquery valued the assets held by two identified collection addresses at approximately $6.01 million, using spot prices at 15:27 UTC on November 7. Its transfer analysis ran through 15:38 UTC, when the Cosmos Hub drain was still continuing. Cosmos Hub accounted for about $3.5 million, while the Injective collector held roughly $615,000. The estimate excluded tokens without reliable market prices and was presented as a floor, not a final loss figure.
The theft also reached staked ATOM. Bitquery traced approximately 1.96 million ATOM through liquid-staking conversions that turned staking positions into transferable share tokens, avoiding the need to wait for the normal 21-day unbonding period before moving those claims. The share tokens were not instantly withdrawable ATOM: they could not be converted back untill the 21-day unbonding period ended or a liquid-staking service accepted them. The operation also redirected about $251,000 in staking rewards, according to the investigation.
Bitquery said the attacker used bundled transactions to process up to six wallets at a time, with a separate gas wallet paying network fees. The pattern recalls the Bloom incident, in which 48 Solana wallets were drained using their own signing keys, although no shared attacker or technical cause has been established.
White-hat recovery changes the loss picture
Web3Auth later confirmed that it had begun white-hat recovery operations with partners, targeting vulnerable wallets that had not yet been drained by using the same path as the original attacker. It said some of those transactions had been mistaken for attacker activity, and that funds recovered through the process were safe. The company is working with Keplr on a recovery route for affected users, but said parts of the process were complex and could take time.
Keplr’s follow-up said some Google- or Apple-login accounts might already show reduced or empty balances because of mitigation efforts. Staked and locked assets require more time, it said, while users with remaining liquid assets were advised to move them to a recovery-phrase or hardware-wallet account. Keplr also warned users not to send new funds to potentially affected accounts and to ignore direct messages or links offering to recover stolen assets.
This changes how the earlier on-chain snapshot should be read. Bitquery’s $6.01 million figure describes balances at two collection addresses at its November 7 cutoff; it is not a confirmed amount still controlled by the attacker after the recovery activity began. Web3Auth has not published a recovered total or a complete address-level reconciliation. The occurence of recovery transactions also means later transfers cannot automatically be attributed to the attacker.
Web3Auth’s Login Service incident notice recorded a maintenance window from November 6 at 18:30 UTC through November 7 at 18:30 UTC. ConsenSys’ status board subsequently listed Web3Auth and its Login Service as operational, but that does not establish that Keplr has restored Google and Apple sign-in or completed its account checks. The original notice did not provide a technical cause, and no detailed post-mortem had been published by the time of writing.
The remaining question is how widely the exposed signing path was used and whether every vulnerable account can be identified before an attacker reaches it. Keplr and Web3Auth have confirmed a private-key exposure and an active recovery effort, but the technical entry point, an official victim count and the amount ultimately returned remain undisclosed. A trace of stolen assets is not the same as a recovery; Dave Finances has previously examined the separate steps between tracing, freezing and returning crypto. The recovery is underway, though the final amount returned is not there yet.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.