01
Keplr Wallet, a popular Cosmos ecosystem wallet, disclosed a security incident in early November 2026.
02
The cause was a vulnerability in Web3Auth, the infrastructure behind Keplr's Google and Apple sign-in feature.
03
Only wallets created through Google or Apple social login were affected, not seed phrase or hardware wallets.
04
Web3Auth splits a user's private key into three pieces using multi-party computation, or MPC.
05
The vulnerability in Web3Auth's own infrastructure exposed some of those key shares, leaking full private keys.
06
Keplr suspended Google and Apple login and told affected users to move remaining funds immediately.
07
Some wallets already show reduced or zero balances from white hat rescue transfers, not necessarily theft.
08
Web3Auth is owned by Consensys, the company behind MetaMask, which acquired it in June 2025.