Keplr wallet exploit drains $6M from social-login accounts via Web3Auth

Between November 6 and November 7, 2026, attackers stole at least $6.01 million from over 44,000 Keplr wallets created via Google and Apple social logins. Blockchain analytics firm Bitquery traced the vulnerability to Web3Auth's infrastructure, which exposed private keys across Cosmos ecosystem networks, including $3.5 million from Cosmos Hub. Keplr suspended social logins and advised users to move liquid assets, though 86% of stolen funds left after initial warnings were issued.

Details and scope of the exploit

• ▪Keplr co-founder Josh Lee stated that the Web3Auth breach affected an estimated 20% of accounts created using social logins
• ▪Bitquery estimated that at least $6.01 million was stolen from Keplr wallets created with Google or Apple logins between November 6 and November 7, 2026
• ▪As of November 8, 2026, neither Keplr nor Web3Auth had disclosed the exact technical cause of the Web3Auth infrastructure breach
• ▪Web3Auth, an infrastructure provider owned by Consensys, confirmed a security vulnerability in its infrastructure exposed the private keys of certain embedded third-party wallets
• ▪The Keplr wallet exploit impacted social-login accounts relying on Web3Auth key handling, leaving accounts created with traditional 12- or 24-word recovery phrases unaffected

Losses and affected networks identified by Bitquery

• ▪Bitquery traced 7,603 impacted wallets to Injective, along with losses on Osmosis and Celestia networks
• ▪Bitquery traced 86% of drained funds on linked networks to transactions that occurred after Keplr issued its initial breach warning on November 7, 2026
• ▪Bitquery reported that approximately $3.5 million of the total losses occurred on Cosmos Hub, including about 1.96 million staked ATOM transferred out without the standard 21-day unbonding period
• ▪Blockchain analytics firm Bitquery identified approximately 44,700 distinct wallets touched by unauthorized transactions, spanning Cosmos ecosystem networks and Injective

Response actions taken by Keplr and Web3Auth

• ▪Keplr immediately suspended Google and Apple social logins following the November 7, 2026 breach discovery and initiated recovery efforts for affected accounts
• ▪Keplr advised users who created accounts via Google or Apple logins to cease depositing funds and immediately transfer remaining liquid assets to secure locations
• ▪Web3Auth suspended its embedded wallet service and implemented protective measures to secure exposed assets following the Web3Auth breach

Third-party wallet integrations

• ▪As of November 7, 2026, the potential impact of the November 7 Web3Auth security vulnerability affecting Keplr wallets on other third-party wallet integrations remained unconfirmed
• ▪Representatives for MetaMask and Trust Wallet confirmed their products were unaffected by the November 7 Web3Auth exploit