Keplr Pauses Google and Apple Logins After Wallet Security Breach

Keplr paused Google and Apple sign-ins Nov. 6 after some accounts recorded unauthorized transactions; Web3Auth identified an infrastructure issue affecting wallets created through those logins.

Keplr tied the incident to a private-key breach linked to Web3Auth’s infrastructure. Keplr said the incident did not affect wallets secured with recovery phrases or hardware devices. Keplr told users with affected accounts not to deposit funds or reimport the wallets, and to move remaining liquid assets to a wallet protected by a recovery phrase or hardware device.

At least 44,041 wallets across seven Cosmos chains and an estimated 7,603 on Injective sent funds to two addresses. After accounting for overlap, the estimate was about 44,700 unique wallets. Web3Auth later identified the addresses as recovery wallets. Their balances were valued at $6.01 million using spot prices from 10:27 a.m. ET (15:27 UTC) Nov. 7; transfers were measured through 10:38 a.m. ET (15:38 UTC).

The $6.01 million tracks transfers to those addresses, not a confirmed theft total. Neither Keplr nor Web3Auth disclosed how many wallets the original attacker drained or the resulting loss.