Keplr pauses Google and Apple login. What went wrong at Web3Auth?
Keplr paused Google and Apple login after unauthorised transactions tied to Web3Auth. Here is what is confirmed, what is still unknown and what users should do.
Keplr, the main wallet of the Cosmos ecosystem, has paused Google and Apple sign-in after users reported transfers they never approved. The problem traces back to Web3Auth, the key-management service behind those logins. The case tests a basic promise of social-login wallets: that signing in with a familiar account can safely replace a recovery phrase.
Summary
- Keplr suspended Google and Apple login after reports of unauthorised transactions. Web3Auth, which supplies the key infrastructure for those logins, paused its embedded wallet service.
- Keplr co-founder Josh Lee estimates that about 20% of its Google and Apple login accounts are affected. He says only a fraction have been exploited and the rest may be recoverable.
- Wallets created with a recovery phrase or a hardware wallet are not affected, according to preliminary assessments. Web3Auth says it has found no evidence that MetaMask users are impacted.
- As of November 7, neither company had disclosed the cause, the total losses or which other apps are affected.
- The reports reviewed describe a failure at the wallet-infrastructure layer. They do not describe an attack on a blockchain or on a smart contract.
This is a developing story. Details below reflect reports available on November 7, 2026, and may change as Keplr and Web3Auth publish their findings.
What happened to Keplr and Web3Auth?
Web3Auth spoke first. In a statement dated November 6, it said a security issue was affecting its services used by some third parties, and that it had temporarily paused its embedded wallet service, according to The Defiant’s report. It added that an initial investigation had found no evidence that MetaMask users were impacted.
Keplr followed at around 04:38 UTC on November 7, CryptoTimes reported. The wallet said it had received reports of unauthorised transactions on accounts created with Google or Apple login, and that it had suspended both options. Web3Auth’s status page also shows its login service in maintenance because of a security incident, according to SpendNode.
Josh Lee, co-founder of Chainapsis, the company that develops Keplr, added detail at around 08:29 UTC. He said the incident was not caused by a hack of Keplr’s own code, and that Keplr is working with Web3Auth and MetaMask to track affected accounts and recover assets, according to TechFlow.
| When | What was reported |
|---|---|
| November 6 | Web3Auth acknowledges a security issue and pauses its embedded wallet service |
| About 04:38 UTC, November 7 | Keplr suspends Google and Apple login and warns affected users |
| About 08:29 UTC, November 7 | Josh Lee estimates about 20% of social-login accounts are affected |
| About 11:30 UTC, November 7 | Web3Auth’s service is still paused and Keplr has not restored social login |
How does a social-login wallet create its key?
A traditional wallet gives the user a 12-word or 24-word recovery phrase. A social-login wallet skips that step. Keplr’s documentation says its Google-login accounts use Web3Auth to generate a private key through distributed key generation, and that the key is encrypted and stored locally on the user’s device, as The Defiant reported.
⚠️ALERT: Crypto wallets created with Google or Apple logins are being hit by unauthorized transactions.Keplr, the main wallet of the Cosmos ecosystem, paused both login options after users reported the thefts.The incident originated at Web3Auth, the login service owned by MetaMask’s parent Consensys, which says it has gone into "maintenance mode due to a security incident."Web3Auth claimed nearly 50 MILLION users across more than 8,200 apps when Consensys bought it last year, per The Block.Keplr’s co-founder estimates about 20% of its Google and Apple login accounts are affected, but says only "a fraction" of those has been exploited and the rest "may be recoverable."Wallets created with a recovery phrase or hardware wallet are NOT affected, and Web3Auth says there is no evidence MetaMask users are impacted.
— Coin Bureau (@coinbureau) November 7, 2026
Web3Auth’s own documentation explains the principle. The private key is split into shares, and a user needs a threshold of them, typically two out of several, to reach the key or sign a transaction. The login factor linked to a Google account is managed and divided across Web3Auth’s network, and the documentation says a login service holding one share cannot retrieve the key on its own.
The design has an obvious appeal: there is no phrase to lose. It also moves part of the security model away from the user’s device and onto a network the user does not control. Web3Auth’s documentation says this varies by product. It describes its single-factor SDKs, which accept only a social login, as semi-custodial, because the key is held by the auth provider and the Web3Auth network together.
The reports reviewed here do not say which setup Keplr’s accounts used. Neither company has explained how the unauthorised transactions were carried out. Handing limited signing power to software is a related design choice, and our explainer on EIP-7702 session keys covers how it works and where it can go wrong.
Who owns Web3Auth, and how many users could be exposed?
Consensys, the software company behind MetaMask, announced its acquisition of Web3Auth on June 2, 2025, for an undisclosed sum, The Block reported. At the time, Web3Auth said it supported nearly 50 million end users and powered more than 8,200 apps. Consensys framed the deal around seed-phrase management, citing data that 35% of users do not back up their phrases.
Those user and app numbers describe Web3Auth’s total reach in 2025. They do not measure how many people or apps are affected now, and neither Web3Auth nor Keplr has published such a count. The ownership link is why Web3Auth addressed MetaMask users directly in its statement. Its status page lists the service under the name MetaMask Embedded Wallets (Web3Auth).
What is confirmed and what is still unknown?
| Confirmed or reported | Not yet disclosed |
|---|---|
| Keplr suspended Google and Apple login | The root cause of the incident |
| Web3Auth paused its embedded wallet service | The total value stolen |
| Recovery-phrase and hardware-wallet accounts are not affected, based on preliminary findings | How many accounts have been drained |
| Web3Auth found no evidence that MetaMask users are impacted | Which other apps using Web3Auth are affected |
| Early estimate of about 20% of Keplr social-login accounts affected | Whether and how victims will be compensated |
The 20% number needs care. It is a preliminary estimate from one co-founder, and CryptoAdventure reported that Keplr has not confirmed a loss total. CryptoTimes also noted that some users on X claimed losses outside Keplr’s stated scope, including older accounts and staked assets. Those claims are unverified.
What should Google and Apple login users do now?
Keplr’s published guidance is short. According to Odaily’s summary, users of potentially affected accounts should not send new funds to them and should not re-import or recreate the accounts anywhere. Keplr also asks users to take updates only from official channels and to be wary of direct messages and links that claim to help recover assets.
The warning about recovery offers matters. Incidents like this attract impersonators, and a message promising to restore stolen funds is more likely to be a second attack than a rescue. Some third-party guides suggest moving remaining balances to a wallet the user fully controls. Keplr’s own guidance, at the time of writing, does not say that, so users should wait for the wallet’s official instructions on X.
Users whose wallets were created with a recovery phrase or a hardware device are not affected, based on the preliminary assessment, and do not need to take special action because of this incident.
What does this say about the trade-off behind social login?
Social login exists to solve a real problem. Losing a recovery phrase can mean losing a wallet for good, and Consensys cited data suggesting that a third of users never back one up. Replacing the phrase with a familiar sign-in lowers that barrier.
The cost is concentration. When many wallets rely on one provider’s key infrastructure, a single failure can reach all of them, whatever the label on each app says. “Non-custodial” describes who is supposed to hold the key. It does not remove the risk that the system generating and recovering the key can fail.
The other side deserves equal weight. Recovery phrases carry their own failure modes, from phishing to stolen backups, and wallet-level breaches are not unique to social login. Atomic Wallet, a phrase-based wallet, lost at least $35 million in a June 2023 breach, and the $6.3 billion Binance hack earlier this month was a far larger key-compromise case. The question for users is which risks they can manage themselves and which they are trusting a provider to manage.
It is also worth separating this event from a chain-level failure. BiGGo Finance noted that no attacks on smart contracts or the underlying chain had been reported. The blockchains involved appear to be working as designed, and the ledger stays tamper-resistant, as our guide to how blockchain immutability works explains. The weak point sits in how some wallets create and protect keys before any transaction reaches a chain.
What to watch
- Web3Auth’s root-cause disclosure: whether it explains how keys or sessions were compromised and whether other integrations were exposed.
- Confirmed losses and account counts: whether the 20% estimate holds and how much was actually taken.
- Service restoration: when Web3Auth’s embedded wallet service and Keplr’s Google and Apple login return, and under what safeguards.
- Recovery and compensation: what Keplr, Web3Auth and MetaMask say about returning funds to affected users.
- Statements from other apps: any other wallet or app built on Web3Auth confirming or ruling out exposure.
FAQs
What is Web3Auth?
Web3Auth is a wallet-infrastructure provider that lets apps offer wallets created through social logins such as Google or Apple. Consensys acquired it in June 2025.
Was Keplr hacked?
Keplr’s co-founder says the incident was not caused by a hack of Keplr’s code. The company says the issue originated at Web3Auth, which supplies the login and key infrastructure.
Are MetaMask users affected?
Web3Auth says its initial investigation found no evidence that MetaMask users are impacted. That is a preliminary finding and may change.
Are recovery-phrase and hardware wallets safe?
Keplr’s preliminary assessment says accounts created with a recovery phrase or a hardware wallet are not affected by this incident.
Can stolen funds be recovered?
Josh Lee says only a fraction of affected accounts have been exploited and the rest may be recoverable. No recovery of stolen funds has been confirmed.
Should I re-import my Google or Apple login account somewhere else?
Keplr advises against it for now. It asks potentially affected users not to re-import or recreate accounts anywhere while the investigation continues.
Does this mean social-login wallets are unsafe?
The cause has not been disclosed, so it is too early to judge the design itself. The incident does show that users of social-login wallets depend on their provider’s infrastructure in ways that recovery-phrase users do not.
Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures and statements are based on sources available at the time of writing, are preliminary and may change. Nothing here is a recommendation to buy, sell or hold any asset. Always do your own research and follow official guidance from the wallet provider. Information is current as of November 7, 2026.
