Keplr Wallet Hack Explained: Why the Web3Auth Vulnerability Only Hit Google and Apple Login Users

Keplr Wallet, a widely used self-custodial wallet for the Cosmos ecosystem, disclosed in early November 2026 that a vulnerability in Web3Auth’s infrastructure had leaked private keys for some users — but only those who had created their wallet by signing in with Google or Apple rather than using a traditional 24-word recovery phrase or a hardware wallet. Keplr suspended social login, urged affected users to move any remaining funds immediately, and said staked or locked assets would take longer to recover.

The incident is a useful real-world test of a wallet design that’s been spreading fast across crypto over the past two years: letting people create a non-custodial wallet with a familiar login instead of a seed phrase. Here’s what actually happened, how that design works, and why it changes what “wallet security” means.

What Happened, and When

Keplr began warning users in a rolling series of posts starting around November 6-7, 2026, with updates continuing into November 8. The company said it had identified unauthorized transactions on some accounts created through Google or Apple sign-in, and traced the cause to a vulnerability in the infrastructure of Web3Auth, the third-party service Keplr uses to power that login option. Keplr suspended the Google and Apple login function while it investigated, according to coverage from KuCoin News and PANews.

Keplr’s own account, posted on its official X account, drew a sharp line for users: “If you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected,” the company wrote, attributing the breach to “Web3Auth’s infrastructure vulnerability leading to private key breach” for users who signed in with Google or Apple (@keplrwallet on X).

As the situation developed, Keplr reported that some affected accounts already showed reduced or empty balances. It attributed at least part of that to its own defensive action rather than theft: Keplr and its partners said they ran white-hat recovery transfers, moving funds out of wallets that were vulnerable to the same attack path but hadn’t yet been drained, as a protective measure, per KuCoin News and follow-up reporting from Cryptonews. Staked and locked assets were flagged as more complex to process and expected to take longer than liquid balances.

Neither Keplr nor Web3Auth had published a confirmed total dollar figure for losses as of this writing, and no official list of which specific networks or token types were affected had been released either. Keplr also warned users directly to ignore any unsolicited messages or links claiming to offer “asset recovery” during the incident — a standard and necessary warning, since live security incidents reliably attract scammers impersonating the affected company.

Why Only Google and Apple Login Users Were Hit

To understand why this incident drew such a clean line between affected and unaffected users, it helps to know what a “social login” crypto wallet actually is.

A traditional self-custodial wallet — the kind that gives you a 24-word recovery phrase — stores your private key (or the information needed to derive it) entirely under your own control. Nobody else ever holds a usable piece of it. That’s powerful, but it also means losing the phrase, or exposing it to malware or a scammer, is catastrophic and irreversible.

Web3Auth exists to solve the “scary seed phrase” onboarding problem by using multi-party computation (MPC). Instead of one private key sitting in one place, Web3Auth splits it into separate shares: one tied to the user’s device, one tied to the login provider’s network, and one serving as a recovery factor. Key generation and signing happen through a distributed consensus process across Web3Auth’s own node network, so that, in theory, no single party — not Web3Auth, not Google, not Apple — ever holds enough of the key to reconstruct it alone (Web3Auth documentation).

That design is genuinely non-custodial when it works as intended. The problem in this incident wasn’t that Google or Apple leaked anything — it was that a vulnerability inside Web3Auth’s own infrastructure, the system coordinating those key shares, was able to expose enough key material to reconstruct working private keys for affected accounts. Wallets created with a seed phrase or hardware device never touch Web3Auth’s systems at all, which is exactly why Keplr could say with confidence that those users were untouched.

Seed Phrase vs. Social Login Wallets: What Actually Changed

	Seed phrase / hardware wallet	Social login (MPC) wallet, e.g. via Web3Auth
Where the key material lives	Entirely with you (phrase or hardware device)	Split across your device, a login provider’s network, and a recovery factor
Onboarding	Requires safely storing 12-24 words	Just a familiar Google/Apple/email login
Biggest risk	You personally lose or expose the phrase	The provider’s infrastructure, not just your device, could be compromised
Affected by this incident?	No	Yes, for accounts using Google/Apple login specifically
Who can fail and hurt you	Only you	You, plus every third party in the key-share chain
Recovery if device is lost	Only works if you still have the phrase	Can often be recovered via the login itself — a convenience and a dependency

Neither model is simply “safer” in every sense — they trade different risks for different conveniences. A seed phrase removes third-party risk entirely but puts all of the burden of safekeeping on one person with no safety net if it’s lost. A social-login MPC wallet lowers the chance of a user losing access entirely, but as this incident shows, it adds the provider’s own security posture as a new point of failure that a seed phrase simply doesn’t have.

A Notable Ownership Detail: Web3Auth and MetaMask

One detail makes this incident worth watching beyond Keplr specifically: Web3Auth isn’t an obscure startup. Consensys, the company behind MetaMask, acquired Web3Auth in June 2025 specifically to bring social-login wallet creation and recovery to MetaMask’s own users, with The Block reporting that the deal was meant to reduce seed-phrase-related losses, which Consensys has called a major source of self-custody risk.

That acquisition means Web3Auth’s infrastructure sits upstream of more than just Keplr — it’s the same technology MetaMask has been integrating for its own embedded-wallet and recovery features. There’s no indication from any source so far that MetaMask’s own wallets were affected by this specific vulnerability, and Keplr’s statement was specific to its own integration. But it’s a reminder that when wallet infrastructure gets consolidated into a handful of shared providers, a vulnerability in that shared layer can potentially ripple across every app built on top of it, not just one wallet brand. This is a different failure mode than MetaMask’s own staking infrastructure incident in September 2026, which involved its Lido-based validator operations rather than key custody, or the Ledger CryptoBilis hardware implant hack, which was a physical supply-chain attack rather than a software one — but all three point to the same underlying lesson: the weakest link in a non-custodial wallet is often not the “non-custodial” part at all, but whatever infrastructure sits around it.

What To Do If You Use Keplr or Any Social Login Wallet

If you created a Keplr wallet using Google or Apple sign-in, Keplr’s guidance, echoed across multiple outlets covering the incident, was direct:

• Stop sending new funds to any wallet created via Google or Apple login until the situation is fully resolved and confirmed safe by Keplr’s official channels.
• Move remaining liquid assets to a wallet created with a recovery phrase or a hardware device — treat the existing social-login wallet’s key as potentially compromised, not just the funds sitting in it today.
• Be patient with staked or locked assets, which Keplr said would take longer to process than freely available balances.
• Ignore any direct message, email, or link offering to “help recover” your assets. Scammers reliably pile onto live security incidents like this one; Keplr explicitly warned users to rely only on its official statements.

More broadly, if you use any wallet — Keplr, MetaMask, Trust Wallet, or another app — that offers a “sign in with Google” or similar option, it’s worth knowing which infrastructure provider sits behind that feature, and understanding that convenience there comes from trusting that provider’s security, not just your own. This isn’t a reason to panic about every MPC or social-login wallet; it’s a reason to know what you’re actually trusting when you pick one, and to have a plan — like keeping a backup self-custody option — if that trust is ever broken. As always, this is not financial advice, and if you believe your own funds may be affected, go directly to Keplr’s or Web3Auth’s official channels rather than any link shared in a message or comment.