Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
Users who established their wallets via Google or Apple logins were affected by a Keplr wallet hack. Web3Auth states that several addresses identified as attacker wallets are actually its own recovery wallets.
This distinction is significant for thousands of Cosmos users. On-chain data provider Bitquery linked more than $6 million to the drain. However, a portion of this amount may now be held in wallets managed by Web3Auth for safekeeping.
How the Keplr Wallet Hack Affected Social Login Users
Web3Auth offers login tools that enable applications to create crypto wallets through social accounts. On November 6, the company halted its embedded wallet service and placed its login service under maintenance.
Initially, the company reported no evidence of impact on MetaMask users, who experienced a separate security incident in October. A day later, Web3Auth identified the flaw within its own infrastructure and confirmed that it affected certain Keplr wallets.
Keplr subsequently disabled Google and Apple sign-ins. The wallet team states that accounts created using a recovery phrase or a hardware wallet are not at risk.
Bitquery identified approximately 44,700 affected Keplr wallets across eight Cosmos-based chains. The largest individual loss amounted to about $325,000.
Related Posts
This incident struck an ecosystem that had already experienced disruption earlier in the year. In the spring, the shutdown of Leap Wallet directed many Cosmos users toward Keplr.
Rescue or Theft? Why the Addresses Matter
Meanwhile, Web3Auth announced it launched a whitehat operation with its partners. The team transferred funds out of vulnerable wallets before the attacker could access them, utilizing the same entry path.
Some observers incorrectly interpreted these transfers as part of the Keplr wallet hack. In response, Web3Auth published verified addresses on Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM chains.
Several of these addresses share a key with collector wallets that Bitquery had associated with the drain. Web3Auth has not disclosed how much of the tracked total it secured.
Recovered funds are secure, according to Web3Auth, and the team is collaborating with Keplr on a method to return them. The company also issued a warning regarding impersonators offering fake recovery assistance.
Other projects took steps to reassure users. PancakeSwap, for instance, stated that its funds and smart contracts remain safe.
The Keplr wallet hack contributes to a challenging year for crypto security. North Korean hackers alone stole $7.61 billion in 2026. Separately, an attacker recently drained over 1,400 Qubic wallets.
