A major security flaw in Web3Auth has exposed Keplr users who sign in with Google or Apple to large-scale theft. Attackers exploited a vulnerability in Web3Auth’s infrastructure, which led to a private key breach for certain wallets opened via those social logins. As a result, several wallets had funds stolen.
What Happened
Keplr—a widely used crypto wallet in the Cosmos ecosystem—relies on Web3Auth for Google and Apple login options. Users who are signed in that way were vulnerable when a flaw in Web3Auth allowed access to private keys, which are essential for authorizing transactions. Those with accounts secured by recovery phrases or hardware wallets remain unaffected. In response, Web3Auth and Keplr suspended both Google and Apple-based logins while they investigate.
Fast Response & Fund Rescue
As soon as the issue was identified, Web3Auth acted aggressively to protect other vulnerable wallets. It transferred funds from at-risk accounts into secure recovery wallets before the attacker could reach them. This means an empty wallet doesn’t always signal theft—sometimes it means the assets were moved for safety. However, staking or locking mechanisms complicate these rescue efforts.
At least 11 Cosmos-based chains and eight Ethereum-like blockchains were involved in the recovery effort. Blockchain analytics firm Bitquery observed over $6 million moved from more than 44,000 wallets into recovery wallets by late last week. Most of these transfers—about 86%—happened after Web3Auth issued its first alert to users. Meanwhile, third-party security group GoPlus estimated the amount stolen at about $1 million, noting only a fraction of affected accounts appeared exploited.
Why Some Funds Were Lost
In many cases, attackers got there first. Josh Lee, co-founder of Keplr, estimated roughly 20% of users with Google or Apple logins had been affected. Among those, only a subset saw actual theft. Details about the exact vulnerability—timing, root cause, exploit path—haven’t been disclosed yet. The companies say they haven’t confirmed whether the exploit route has been fully sealed.
What To Do If You’re Affected
If you signed into Keplr using Google or Apple:
• avoid sending new crypto to your affected account.
• don’t re-import or recreate that account elsewhere.
• move any non-staked or unlocked assets into a wallet you control via a recovery phrase or hardware key.
• only trust communications from verified Keplr and Web3Auth channels—don’t follow unsolicited recovery instructions via links or direct messages.
The recovery process for staked or locked assets is ongoing and slower. Web3Auth has published a list of recovery addresses to help users verify legitimate transfers, and it is collaborating with Keplr to help users check if their account was hit.
Broader Implications
While Keplr is the only named wallet affected so far, Web3Auth confirmed the vulnerability exists in its embedded wallet service, which is used by various other apps. The login service remains offline as it undergoes remediation. Importantly, MetaMask—whose parent company acquired Web3Auth in June 2025—has stated that its users are not believed to be impacted.
Overall, this incident underscores the risks involved in using social logins for self-custodial crypto wallets. Relying on Google or Apple credentials creates an additional attack surface: if those credentials or the intermediary service is compromised, it can lead to irreversible asset loss. Hardware wallets and recovery phrases remain the gold standard for security.
For users who depend on staking or locking, the story isn’t over: recovery of those assets could take weeks or longer, depending on chain mechanics. Web3Auth and Keplr both say they are working toward restoring full service and communicating directly with affected users.
Why This Matters
This episode highlights the trade-offs between usability and security in blockchain wallets. While social login options reduce friction for onboarding, they may weaken control if underlying services are compromised. The crypto industry has long warned against private key exposure—but this attack shows how an indirectly related service can become a critical link in the chain. Going forward, wallet makers will likely double down on supporting non-custodial models and educating users about the importance of personal key management.
