Keplr Wallet Breach Drains 44,700 Social Login Wallets
- Who should care: Anyone caught in the Keplr wallet breach through a Google or Apple login, and every team shipping social login wallets.
- What could go wrong: Someone else signs transactions as you. Or your balance hits zero, and you can’t tell theft from rescue.
- Do this: Stop depositing into social login Keplr accounts. Move liquid funds to a seed phrase or hardware wallet today.
- Worth remembering: Keplr’s code was never touched. The weak link sat one vendor away.
Introduction
Click “Sign in with Google,” get a crypto wallet. That convenience just backfired. The Keplr wallet breach came through Web3Auth, the login provider behind Keplr’s Google and Apple accounts. A flaw there exposed private keys and let attackers sign transactions for thousands of users.
Nobody hacked Keplr. They walked in through the door Keplr rented. That makes this a textbook case of vendor breach accountability, and a warning for any app that hands key material to a third party.
What Happened?
On the evening of November 6, Web3Auth paused its embedded wallet service after spotting a security issue affecting third-party customers. The next morning, Keplr confirmed unauthorized transactions in Google and Apple login accounts and disabled both options.
Blockchain analytics firm Bitquery counted 44,041 drained wallets across seven Cosmos chains, plus 7,603 on Injective. That’s roughly 44,700 unique wallets. About 86% of them sent funds out after Keplr’s first warning, so the Keplr wallet breach kept running well after the alert went out.
Seed phrase and hardware wallet accounts were untouched.
Rescue or Robbery?
This is where the Keplr wallet breach gets messy. Web3Auth started sweeping funds out of exposed wallets before the attacker got to them, using the same path the attacker used. On-chain, a rescue looked exactly like a theft.
Bitquery tied $6.01M to the drain. Then eight addresses it had linked to the attacker showed up on Web3Auth’s list of 12 verified recovery wallets, which hold about $5.6M. GoPlus puts confirmed theft at $1M or more. Nobody has published a root cause yet.
What’s the Impact of the Keplr Wallet Breach?
Keplr estimates about 20% of social login accounts were exposed, and only some of those were actually exploited. Some users now stare at empty balances with no way to tell rescue from loss.
There’s no reimbursement plan or return timeline for Keplr wallet breach victims yet. Meanwhile, fake “recovery agents” are already circling, a classic setup for spear phishing against people who just lost money.
How to Avoid This
- Stop sending funds to any Keplr account created with Google or Apple login.
- Move liquid assets to a seed phrase or hardware wallet you control.
- Check each outgoing transfer against Web3Auth’s recovery list before assuming theft.
- Ignore DMs offering “asset recovery.” Real updates come only from official channels.
- If you build with embedded wallets, know which vendor holds key material and how fast you can cut it off.
Your Riskiest Code Might Live in Someone Else’s Data Center
Keplr’s wallet held up. The vendor holding its users’ key material didn’t. Most security programs stop at the code they own, and attackers have noticed. The Keplr wallet breach joins the Polymarket script swap and the Binance fake job interview heist as proof that crypto’s weakest link usually sits outside the main codebase.
- Red Teammate maps every third-party service in your login and signing path, then tests what an attacker could reach through it.
- AppSec Teammate tracks embedded SDKs and vendor services the way it tracks your own dependencies.
- SOC Teammate pulls vendor notices, on-chain alerts, and user reports into one case, so your team spots the pattern before the second wave.
- Big moves like cutting off a login provider stop at your approval gate, with a record of who decided and why.
- Your team sets the rules. AI teammates do the work. Attack. Harden. Prove. Repeat.
