Keplr Social Logins Hit by Web3Auth Flaw, $6M Moved

At least $6.01 million in transfers hit collector addresses across Cosmos chains after a flaw at authentication provider Web3Auth exposed private keys behind some Keplr Google and Apple logins. Keplr suspended both login methods on Nov. 7. Bitquery's $6.01 million is observed movement, not a confirmed theft total, because part of it is white-hat rescue.

Web3Auth disclosed a security issue on Friday, Nov. 6. By early Saturday, Keplr was reporting unauthorized transactions on accounts created through Google and Apple login, and it paused those logins after the reports.

View the post on X

Josh Lee, co-founder of Chainapsis, the company behind Keplr, said the vulnerability originated with Web3Auth, not Keplr's own software. Early estimates put about 20% of social-login accounts in the affected bucket, though only a fraction had reportedly been exploited. Accounts created with a recovery phrase or hardware wallet are unaffected.

What the on-chain data shows

Bitquery examined Nov. 6-7 transactions across Cosmos Hub, Osmosis, Celestia, Akash, Noble, Dydx, Babylon and Injective. At Nov. 7 valuations, Cosmos Hub accounted for about $3.50 million, Osmosis $1.04 million and Injective $615,000.

The spread is wide. Bitquery counted about 44,700 distinct private keys involved, and on seven linked networks 86% of affected wallets saw transfers after Keplr's initial warning. Median wallet loss: $1.34. Largest single transfer: close to $325,000.

Staking was hit too. About 1.96 million staked ATOM moved without the 21-day unbonding period, via liquid staking mechanisms that converted positions into transferable share tokens. About $251,000 in staking rewards was redirected.

Hack or rescue? Both, apparently

The headline number is muddy. Keplr and Web3Auth confirmed that white-hat recovery operations were using the exposed access path to move vulnerable assets into protective custody. On Nov. 8, Keplr identified recovery addresses that overlap with several collector wallets Bitquery examined.

"we have been transferring assets into secure recovery wallets, with assistance from Keplr."

Web3Auth

View the post on X

Web3Auth published the recovery-wallet addresses on Nov. 8 after some recovery transactions were mistaken for attacker activity, and Keplr confirmed the list. It covers Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, plus an EVM address.

"Web3Auth has verified the following addresses as related to the recovery efforts, not malicious/exploit addresses,"

Keplr

The onchain record shows the confirmed Cosmos Hub recovery address received a Nov. 7 batch that tokenized 2,265.59 staked ATOM from six accounts. That stake was not turned into immediately spendable ATOM. It sits awkwardly next to Bitquery's 1.96 million ATOM figure; the two appear to measure different things, and neither source reconciles them.

What users should do

Keplr told Google and Apple login users not to send new funds, to move remaining liquid assets to a recovery-phrase or hardware-wallet account, and to ignore DMs or links offering recovery. Staked and locked assets take longer to secure. Some users may see empty balances because their assets were moved for safekeeping.

What we still don't know

The teams have not disclosed the precise technical cause, a definitive loss figure, the amount secured, a process for returning assets, or a reimbursement schedule. Web3Auth said it will expand the address list as more are verified.

For anyone holding through a social login, the play is Keplr's own guidance: get liquid assets out to a recovery-phrase or hardware-wallet account, and assume every DM promising recovery is a drainer. The $1.34 median against a near-$325,000 top transfer says the dollar total rides on a handful of big wallets. Whether those big moves were theft or rescue is what decides the real damage.