Keplr Pauses Google and Apple Login After Unauthorized Transactions in Web3Auth Wallets

Published November 7, 2026, 12:20 PM PKT. Based on Keplr's statement of November 7, 2026, as reported by The Defiant (primary source), Web3Auth's disclosure as reported by Cryptovka (primary source), and reporting from Phemex News (secondary reporting).

Keplr Wallet has paused Google and Apple sign-in after reports of unauthorized transactions affecting users who logged in through Web3Auth, the social-login infrastructure behind the wallet's one-click accounts. Keplr said it is investigating the reports with Web3Auth and warned users who signed in with Google or Apple to stop sending funds to their accounts while the investigation runs. The Defiant reported the pause on November 7, 2026, at 06:12 UTC, about an hour before this article was published. Web3Auth has temporarily suspended its embedded wallet services as a precaution while a forensic investigation is conducted, according to Cryptovka. Neither company has disclosed how much money was moved, how many users are affected, or what caused the incident.

Google and Apple login paused, funds warning issued

Keplr has temporarily disabled Google and Apple sign-in options following reports of unauthorized transactions affecting users who authenticated through those methods, Phemex News reported. The wallet provider urged impacted users to immediately stop adding funds to their accounts while the issue is investigated. Keplr also advised users not to transfer new funds to affected accounts and to refrain from using those accounts on any other platforms until further notice, according to Cryptovka. The company continues to investigate the source of the unauthorized activity and has not yet provided a timeline for restoring the suspended login methods, Phemex News reported.

Keplr is a leading wallet for the Cosmos ($ATOM) ecosystem, and the incident reaches users across the networks it serves. Cryptovka advised users in the Cosmos ($ATOM), Celestia ($TIA) and Osmosis ($OSMO) ecosystems to monitor their balances closely through blockchain explorers until Web3Auth gives a formal all-clear, and to consider moving assets to hardware-backed addresses. The wallet is developed by Chainapsis and serves as a gateway to the Cosmos ecosystem's many independent networks, with social login offered as a beginner-friendly onboarding path alongside the standard 24-word recovery phrase.

The Web3Auth social-login link

The breach sits in the social-login layer, not in Keplr's core wallet. Web3Auth provides embedded wallet services that let users create and access crypto wallets through third-party social accounts such as Google and Apple, without handling a seed phrase themselves. According to Cryptovka, Web3Auth reported a significant security breach affecting its embedded wallet services, and the unauthorized transactions hit accounts created through those social-login integrations. Web3Auth clarified that MetaMask users have not been affected by this incident, Cryptovka reported, suggesting the problem is localized to the integration protocols used by specific third-party applications rather than a compromise of the wider wallet software.

That distinction matters because social login trades away one of the core protections of a non-custodial wallet. In a standard Keplr account, the private key is derived from a recovery phrase held only by the user. In a social-login account, Web3Auth's infrastructure holds a share of the key material and reconstructs it when the user signs in with Google or Apple, which means a failure in that infrastructure can expose the account even if the user did nothing wrong. Web3Auth has suspended all of its embedded wallet functions while it investigates, according to Cryptovka, which also limits the damage to accounts already affected.

Who is affected, and who is not

The affected group is narrow but the warning is blunt. Users who registered or accessed their digital assets through Google or Apple accounts appear to be the primary victims of the unauthorized fund movements, Cryptovka reported. Keplr said in its initial assessment that accounts accessed through a recovery phrase or a hardware wallet remain unaffected, and that the security of users relying on traditional mnemonic phrases or cold storage remains intact. For those using the affected social-login path, however, the risk remains active until a patch is deployed and verified, Cryptovka reported.

What is still unknown is as important as what is confirmed. Neither Keplr nor Web3Auth has said how many accounts were hit, how much was taken, which chains the stolen funds moved across, or whether the attacker still has access. No attacker has been named and no attribution has been offered. The Defiant's report, published at 06:12 UTC on November 7, carries only the initial assessment, and both companies said the investigation is ongoing. Until a fuller disclosure arrives, the only safe reading is the one Keplr itself gave: social-login users should treat their accounts as at risk and send nothing more to them.

What happens next

The next disclosure will decide how serious this incident turns out to be. The first thing to watch is whether Keplr or Web3Auth publishes a number: how many accounts were affected and how much was moved. The second is the root cause, since a flaw in the social-login key reconstruction would raise questions for every other app that uses Web3Auth, not just Keplr. The third is the restoration timeline for Google and Apple login, which Keplr has not yet given. The fourth is whether either company offers compensation or a migration path for affected users to move their funds to recovery-phrase or hardware-backed accounts.

The incident lands in a month already crowded with security failures. Hackers linked to North Korea stole about $6.3 billion from Binance on October 29, 2026, according to the FBI, and the exchange is still restoring withdrawals in phases. South Korean exchange GOPAX froze trading and withdrawals on November 6 after a hacking threat, and hardware wallet maker Keystone disclosed on October 26 that an intruder took about 25,964 customer records. The Keplr incident is smaller in scale than the Binance theft, but it hits a different nerve: it shows that the convenience layer built on top of self-custody can fail even when the underlying wallet does not.

Sources

• Keplr Wallet, statement, November 7, 2026 (primary source: Google and Apple login paused after unauthorized transaction reports, investigating with Web3Auth, recovery-phrase and hardware-wallet accounts unaffected in initial assessment, social-login users warned to stop sending funds; statement as reported by The Defiant, Keplr Pauses Google and Apple Login After Unauthorized Transaction Reports, November 7, 2026)
• Web3Auth, security disclosure, November 7, 2026 (primary source: significant security breach affecting embedded wallet services, unauthorized transactions for certain users, social-login mechanism targeted, Google and Apple account users the primary victims, MetaMask users unaffected, all embedded wallet functions suspended pending forensic investigation; disclosure as reported by Cryptovka, Web3Auth Security Incident Leads to Unauthorized Keplr Wallet Transfers, November 7, 2026)
• Phemex News, Keplr Pauses Google and Apple Login Over Unauthorized Transactions, November 7, 2026 (secondary reporting: Google and Apple sign-in temporarily disabled, users urged to stop adding funds, no timeline for restoring the login methods)
• MABOnChain reporting, November 2026 (context: Binance October 29 hack of about $6.3 billion attributed to North Korea by the FBI, GOPAX trading and withdrawal freeze of November 6, Keystone disclosure of about 25,964 customer records on October 26)

This article is news reporting and is not investment advice.