Keplr: wallets opened with Google or Apple have been drained
Keplr is a crypto wallet widely used for Cosmos (ATOM) and its neighboring networks. You could open it with your Google or Apple account, without a recovery phrase to keep somewhere safe. This login service isn't built by Keplr itself: it's provided by Web3Auth, a company bought in 2025 by Consensys, the company behind MetaMask.
On 6 November, Web3Auth had a security problem. The next day, Keplr reported transactions that their owners hadn't made, on some of the wallets opened with Google or Apple, and shut down those logins. Google and Apple weren't hacked: it's the provider sitting between them and Keplr that failed.
If your Keplr was created with a recovery phrase or linked to a hardware wallet (Ledger…), it isn't affected, according to Keplr. If you opened it with Google or Apple, don't send anything more to it, move what's left to a wallet with a recovery phrase by following Keplr's official instructions, and ignore any private message offering to “recover” your funds: it's almost always a scam.
Keplr: the Web3Auth flaw drains about $6 million on Cosmos
Web3Auth, the Consensys service that lets you open a wallet with a Google or Apple account, suspended its embedded wallet offering on 7 November after a “security issue” affecting some of its clients. Keplr, one of them, had reported unauthorized transactions overnight on accounts created this way, and shut down those logins. Keplr is adamant that its own code isn't at fault.
According to Bitquery, about $6 million left some 44,700 wallets, on seven networks in the Cosmos ecosystem and on Injective, including $3.5 million on the Cosmos Hub. Josh Lee, Keplr's co-founder, estimates that about 20% of Keplr accounts opened with Google or Apple could be affected, and that only some of them were actually drained. This figure is provisional, and it doesn't apply to all Keplr accounts or to all Web3Auth users.
The “50 million users” figure going around comes from Web3Auth itself, which claimed nearly 50 million users when it joined Consensys in 2025: that's its audience, not the number of victims. Web3Auth says it has found, so far, no impact on MetaMask users. An empty balance doesn't necessarily mean theft: security teams move funds along the same path as the attacker to keep them safe. The losses still have to be tallied, and nothing guarantees a refund yet.
Read the expert version
Keplr and Web3Auth: 44,700 Cosmos wallets hit, and the full damage is still unclear
On 7 November, Web3Auth (part of Consensys since June 2025) paused its “embedded wallets” service after an incident affecting third-party integrators, and said that an initial investigation had found no sign of impact on MetaMask users. A few hours earlier, Keplr had reported unauthorized transactions on accounts created through Google or Apple login, and suspended both methods. Web3Auth then confirmed that the flaw affected Keplr's embedded wallets and started moving funds to safety.
Bitquery puts the outflows at about $6.01 million to two collection addresses, from 44,041 wallets on seven Cosmos networks and 7,603 addresses on Injective, or about 44,700 wallets once duplicates are removed. The Cosmos Hub accounts for about $3.5 million, followed by Osmosis, Celestia, Akash, Noble, Babylon and dYdX. Bitquery also notes 1.96 million staked ATOM taken out through tokenization of staking shares, which avoids the 21-day unbonding period. Josh Lee suggests that about 20% of Keplr accounts using social login could be exposed, with only a fraction actually exploited.
Two caveats before drawing conclusions. First, the “white hat” operations use the same path as the attack: part of the outflows counted by Bitquery may be funds moved to safety, and it's not yet possible to tell losses from recoveries. Second, the “50 million users” quoted here and there is the user base Web3Auth claimed when it was acquired, not a measure of exposure. Accounts with a recovery phrase or a hardware wallet aren't affected, according to Keplr, and no compensation has been announced.
