Skip to main content
Web3Auth Flaw Exposes Keplr Social-Login Keys
Sicherheit
Security
4 min read65 views

Web3Auth Flaw Exposes Keplr Social-Login Keys

Floriano Righetti
Floriano Righetti

On 6 November 2026, Web3Auth, the login service that powers Google and Apple sign-in for Keplr Wallet, said it had found a security issue in its infrastructure and paused its embedded wallet service. By the next morning Keplr was reporting unauthorised transactions on accounts created with those social logins. Both firms now say private keys for some of those accounts were exposed. Accounts created with a recovery phrase were not affected, Keplr says. Web3Auth also says it has found no evidence that MetaMask users were hit.

What happened#

Keplr’s social login never shows the user a recovery phrase. Web3Auth rebuilds the wallet key when the user signs in with Google or Apple. That convenience also means a flaw in Web3Auth’s systems can put those keys within reach of anyone who can abuse the same path.

Web3Auth’s first public notice came at 21:13 UTC on 6 November. Keplr warned users at 04:38 UTC on 7 November, paused Google and Apple login, and told affected users not to send new funds to those accounts and not to re-import them. Later that day Web3Auth said it had begun a “whitehat recovery”: using the same path as the “original attacker” to empty vulnerable wallets that had not yet been hit, and move the assets into addresses it controls.

On 8 November Web3Auth published a list of verified recovery addresses across Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, Agoric and eight EVM networks. Keplr reposted the same list and warned against impersonators offering fake recovery help.

What the numbers show — and what they do not#

Bitquery’s rewritten investigation (figures verified 8 November) measured at least $6.01 million, priced as of 7 November, that left at least 44,041 Keplr social-login wallets on seven Cosmos chains, plus about 7,603 on Injective, into addresses that both firms now list as Web3Auth recovery wallets. The Block, reviewing on-chain balances on 8 November, put about $5.6 million across the twelve published recovery wallets, including roughly 2.49 million ATOM on Cosmos Hub (about $3.3 million at the time of its report).

Those figures are observed transfers into recovery addresses, not a confirmed theft total. Bitquery first labelled the sweeps as theft, then corrected after Web3Auth and Keplr named the destinations. Neither company has said how much the original attacker took, how many wallets it emptied, or named an attacker address. Bitquery notes that its count starts from the recovery wallets, so it cannot see wallets emptied elsewhere.

As reported by The Block and Bitcoin.com, Keplr co-founder Josh Lee estimated that about 20% of Google and Apple login accounts were exposed, and that only a fraction of those had actually been exploited. We treat that as an estimate relayed by those outlets, not an independently verified census.

Bitquery also reports that about 1.96 million staked ATOM left without the usual 21-day unbonding wait, after stakes were turned into liquid share tokens, and that about 86% of the wallets in its seven-chain sample were swept after Keplr’s warning. Web3Auth says the recovery targeted wallets that were vulnerable but not yet impacted; on a ledger, a rescue and a theft look the same.

Our view#

As XDRIP Digital Management LLC, we see a clear custody lesson. When a wallet’s spending key is rebuilt by a third-party login service, that service becomes part of the security boundary. A flaw there can empty accounts that never showed their owners a recovery phrase. Keplr’s guidance — do not deposit into exposed social-login accounts, move remaining liquid assets to an account you control with a recovery phrase, and ignore unofficial “recovery” messages — is the practical baseline while the firms work on return paths.

Open questions remain: the technical root cause, how much the original attacker took, how and when recovered assets will be returned, and whether further chains will appear in the recovery totals. We will follow official updates from Web3Auth and Keplr.

Sources#

Share this article

Related Articles