According to BeInCrypto, a security breach linked to Web3Auth’s social‑login infrastructure compromised Keplr wallets that were created using Google or Apple accounts. On November 6, Web3Auth halted its embedded wallet service and placed its login system under maintenance after detecting the issue. The following day the company traced the vulnerability to its own backend, confirming that the flaw had exposed a subset of Kepr wallets. Keplr responded by disabling Google and Apple sign‑ins, while stating that wallets generated with a recovery phrase or hardware device were unaffected.

Scope of the breach

On‑chain analytics firm Bitquery identified approximately 44,700 affected Keplr wallets across eight Cosmos‑based chains, with the total value of drained assets exceeding $6 million. The largest single loss recorded was about $325,000. The breach primarily impacted users who relied on Web3Auth’s social‑login feature to create their wallets, a method that had grown in popularity after the Leap Wallet shutdown earlier in the year.

Recovery efforts and disputed figures

Web3Auth launched a white‑hat operation with partners to move funds out of vulnerable wallets before attackers could access them, using the same access path. The firm later published a list of verified recovery addresses on several platforms, including Injective, dYdX, Babylon, Axelar, Saga, Agoric, and eight EVM chains. Some of these addresses share keys with collector wallets that Bitquery linked to the theft, leading to confusion over whether the transfers represented recovered assets or part of the hack. Crypto Briefing reported that Web3Auth disputes the $6.01 million theft estimate, asserting that the funds were transferred to its own recovery wallets rather than being stolen. Web3Auth has not disclosed the exact amount it secured, but says the recovered assets are safe and it is working with Keplr to return them to rightful owners.

Community response and next steps

Other projects in the Cosmos ecosystem, such as PancakeSwap, reassured users that their funds and smart contracts remain secure. Web3Auth also warned users about impersonators offering fake recovery assistance. The incident adds to a series of high‑profile security events in 2026, including a North Korean hacking campaign that stole $7.61 billion and an attack that emptied more than 1,400 Qubic wallets.

What to watch next

Observers will monitor how Web3Auth and Keplr coordinate the return of recovered assets and whether additional vulnerable wallets are identified. The broader crypto community is likely to scrutinize social‑login solutions for wallet creation, potentially prompting tighter security audits or alternative onboarding methods.