Keplr Says Web3Auth Flaw Exposed Private Keys, Tells Social-Login Users to Move Funds

Published November 8, 2026, 09:18 AM PKT. Based on a Keplr update reported on November 8, 2026 (primary source), with secondary reporting from Crypto Adventure and The Defiant, and MABOnChain's earlier coverage of the incident.

Keplr has told users who created wallets with Google or Apple logins to stop sending funds to those accounts and move any remaining assets to wallets made with a recovery phrase or a hardware wallet, after confirming that a flaw in Web3Auth's infrastructure exposed some private keys. The update, reported on November 8 by Odaily Planet Daily, is the sharpest escalation yet in an incident that began with reports of unauthorized transactions on November 7, and it turns a warning to watch accounts into a direct instruction to move funds.

Keplr said a vulnerability in Web3Auth's infrastructure led to the exposure of private keys for some users who logged in via Google or Apple. The wallet maker is assisting Web3Auth in securing the assets of affected users, and it said the resolution process is ongoing. Handling staked and locked assets is more complex and will require additional time, Keplr said, and some accounts may already show reduced or zero balances because of the protection measures the two companies have taken.

About 20 percent of social-login accounts may be affected

Keplr co-founder Josh Lee, whose company Chainapsis builds Keplr, estimated that about 20 percent of accounts created through Google or Apple login could be affected, Crypto Adventure reported on November 7. Lee stressed that only a fraction of those potentially vulnerable accounts appeared to have been exploited, leaving open the possibility of recovering access to others. He also said the incident originated at Web3Auth, not from a vulnerability in Keplr's own application code.

Keplr's social login system uses Web3Auth's distributed key generation infrastructure, which lets users create crypto wallets through an existing Google or Apple account instead of writing down a recovery phrase. The wallet generates private keys through Web3Auth and stores encrypted credentials locally. The exact mechanism that let an attacker take control has not been disclosed.

Accounts created with a recovery phrase or a hardware wallet are not affected, Keplr said in its initial assessment. Web3Auth, which is owned by MetaMask developer Consensys after a 2025 acquisition and also brands its service as MetaMask Embedded Wallets, said its initial investigation found no evidence that MetaMask users were impacted.

What users were told to do

Keplr's guidance to Google and Apple login users is specific. Do not send new funds to those accounts. Move any remaining liquid assets to an account created with a recovery phrase or a hardware wallet. Do not re-import or recreate the affected account in another application while the investigation continues. Keplr also warned users to trust only official communications from Keplr and Web3Auth, and to ignore direct messages or links claiming to recover assets, a warning that matters because fake recovery offers are a standard follow-up scam after wallet breaches.

Web3Auth said it is preparing a verified list of recovery addresses, and it warned users not to assume that an unfamiliar destination address belongs to an attacker, The Defiant reported. Some recovery transfers have already been mistaken for attacker activity, according to Web3Auth.

The 2,265.59 ATOM batch: recovery or theft

One on-chain episode shows how hard it is to tell recovery from theft while the incident is still unfolding. The Defiant reported that a Cosmos Hub transaction on November 7 converted 2,265.59 staked Cosmos ($ATOM) from six accounts into transferable staking claims and sent them to a single address. The transaction was recorded at 5:18 a.m. Eastern time on November 7 and carried the memo "lsm recovery batch." The Hub's liquid staking module converts a delegation into transferable tokens, which lets ownership change without waiting through the normal 21-day unbonding period.

One delegator, posting as Stan on a Cosmos forum, identified one of the six accounts as his and said 356.009956 ATOM from that account was tokenized without his approval. A later balance query showed the destination still held the full share-token amount sent from Stan's account. It remains unconfirmed whether the six accounts were affected by the wider breach, and whether the recipient is an attacker or a recovery operator, The Defiant reported.

Community investigators have also traced suspicious movements involving Injective ($INJ) and Osmosis ($OSMO) tokens alongside Cosmos ($ATOM), Crypto Adventure reported. Neither Keplr nor Web3Auth has verified those figures.

What is still unknown: losses, root cause, refunds

Neither Keplr nor Web3Auth has disclosed an official loss total or the number of affected users. Early community estimates put initial losses above $700,000, with later independent tracking suggesting substantially larger outflows, Crypto Adventure reported, but neither company has verified those figures, so they should not be treated as confirmed losses. The full technical cause has not been published, and there is no reimbursement plan and no timeline for restoring Google and Apple login.

The timeline so far: Web3Auth disclosed a security issue on November 6 and paused its embedded wallet service at 21:13 UTC that day, saying it had found no evidence that MetaMask users were impacted. Keplr followed at 04:38 UTC on November 7, saying it had received reports of unauthorized transactions on some accounts created with Google or Apple login. Lee's estimate of about 20 percent came later on November 7, and Keplr's transfer advisory followed as the two companies moved from investigation to active recovery.

What to watch next

Four things will show how this ends. The first is an official loss total and affected-user count from Keplr or Web3Auth, which would replace the unverified community estimates. The second is a technical root-cause write-up, which neither company has published. The third is Web3Auth's verified list of recovery addresses, which should settle whether batches like the 2,265.59 ATOM transfer were recovery work. The fourth is a reimbursement decision and a date for restoring social login, neither of which has been announced. MABOnChain covered the first reports of unauthorized transactions on November 7, and will update this story as the two companies publish more.

Sources

• KuCoin News, citing Odaily Planet Daily, Keplr Wallet Security Incident: Users Advised to Transfer Assets Due to Private Key Leak, November 8, 2026 (primary source: Keplr issued an update saying a vulnerability in the Web3Auth infrastructure led to the exposure of private keys for some users who logged in via Google or Apple; users should stop depositing new funds into those accounts and transfer remaining transferable assets to accounts created via mnemonic phrases or hardware wallets; some affected accounts may already show reduced or zero balances due to asset protection measures; staked or locked assets may require additional time; users should trust only official communications and beware of messages impersonating asset recovery services)
• Crypto Adventure, Keplr Wallet Drains Hit Google and Apple Login Users, November 7, 2026 (secondary reporting: Keplr co-founder Josh Lee estimated about 20 percent of social-login accounts could be affected, with only a fraction of those appeared exploited; the incident originated at Web3Auth, not Keplr code; Web3Auth acknowledged the incident on November 6 and disabled its embedded wallet service; no evidence MetaMask users were affected; community investigators traced suspicious movements involving ATOM, OSMO and INJ tokens, with unverified estimates above $700,000 initially and larger later; no reimbursement plan or restoration timeline announced)
• The Defiant, via Newisty, Cosmos batch moves 2,265.59 staked ATOM from six accounts amid theft report and recovery claim, November 8, 2026 (secondary reporting: a November 7 Cosmos Hub transaction converted 2,265.59 staked ATOM from six accounts into transferable staking claims sent to one address, memo "lsm recovery batch"; one delegator said 356.009956 ATOM was tokenized without his approval; Web3Auth said some recovery transfers have been mistaken for attacker activity; whether the recipient is an attacker or a recovery operator remains unconfirmed)
• MABOnChain, Keplr Pauses Google and Apple Login After Unauthorized Transactions in Web3Auth Wallets, November 7, 2026 (context: Keplr paused Google and Apple login on November 7 after users reported unauthorized transactions on accounts created through those services, and Web3Auth said it had entered maintenance mode due to a security incident)

This article is news reporting and is not investment advice.