Key Highlights:
- A security vulnerability in Web3Auth’s infrastructure compromised thousands of Keplr social-login wallets across Cosmos and Injective, while standard seed phrase and hardware wallets remained entirely unaffected.
- Blockchain tracking firm Bitquery identified over 51,000 impacted addresses across the Cosmos and Injective networks, whereas initial external theft estimates reached $6.01 million.
- Web3Auth has strongly contested the $6.01 million figure, clarifying that many recorded outflows were whitehat asset rescues, and has published verified recovery addresses spanning 11 Cosmos networks and eight EVM chains.
Security Flaw Hits Keplr Wallets Linked to Social Authentication
Over November 6 and 7, 2026, unusual transaction activity exposed a major security incident within the Cosmos ecosystem, draining digital assets from select Keplr wallets. The unauthorized transfers were restricted strictly to accounts that utilized social login integrations rather than traditional security configurations. According to blockchain data analytics provider Bitquery, the incident reached more than 44,041 affected wallets within the broader Cosmos ecosystem, in addition to 7,603 wallets on the Cosmos-based blockchain Injective.
Web3Auth, the identity infrastructure provider powering the integration, confirmed the presence of a vulnerability on November 6 and subsequently paused its embedded wallet service that same day. Keplr co-founder Josh Lee clarified that the breach originated from a defect in Web3Auth’s services rather than Keplr’s core wallet architecture. Lee stated that the issue affected roughly 20% of wallets created through Google and Apple logins. Conversely, traditional accounts established using standard 12- or 24-word recovery phrases or secured via hardware devices showed no evidence of compromise and remained completely safe.
The Dispute Surrounding the $6.01 Million Loss Figure
In the immediate aftermath of the incident, public post-mortems and tracking tallies estimated total losses at approximately $6.01 million based on assets flowing out of the compromised addresses during the incident window. However, Web3Auth has openly contested this amount, arguing that the tally erroneously bundled legitimate emergency operations with malicious theft. According to Web3Auth, several transactions flagged as exploits were actually proactive whitehat recovery operations conducted internally alongside security partners to protect remaining funds.
Because these emergency rescue efforts relied on identical technical vectors to the unauthorized drains, distinguishing whitehat actions from malicious theft on-chain in real time proved difficult. In response, Web3Auth published a comprehensive list of verified recovery addresses by November 8. This directory covers eleven Cosmos-based networks and eight EVM-compatible chains, enabling external analysts and users to verify that recovered assets reside securely in company-controlled addresses rather than in the possession of an attacker.
Emergency Advisories and Fund Migration Protocols
Both Keplr and Web3Auth issued critical warnings instructing affected individuals to disregard third-party assistance or unofficial refund offers, urging them to monitor only official company channels for ongoing updates. Keplr also advised users to immediately halt any incoming deposits into impacted social-login accounts and urged them to transfer their remaining digital assets to newly generated, secure accounts backed by standalone recovery phrases or hardware security modules.
Why This Matters
The Keplr-Web3Auth incident underscores a fundamental structural tradeoff in contemporary cryptocurrency onboarding. While social logins using Google or Apple IDs eliminate the friction of managing complex seed phrases for mainstream users, they shift key management dependencies toward centralized third-party providers. As demonstrated in this event, an upstream software vulnerability in a shared infrastructure layer can instantly expose tens of thousands of wallets across different networks, whereas self-custodial seed phrases and cold-storage hardware isolate risk to the individual.
Furthermore, the conflict regarding the $6.01 million figure highlights an ongoing analytical hurdle in decentralized incident response. While public ledgers provide instant visibility into transaction volume, they do not inherently reflect intent. Distinguishing between active exploit drains and whitehat defensive operations requires transparent communication and verifiable recovery ledgers, allowing the broader Web3 ecosystem to audit post-exploit balance sheets rather than relying on unverified estimates.
Frequently Asked Questions
Were Keplr hardware wallets or seed-phrase accounts compromised?
No. Keplr confirmed that wallets generated using standard recovery seed phrases or secured through hardware devices were entirely unaffected by the vulnerability. The issue was isolated exclusively to wallets created using Web3Auth’s social-login feature via Google and Apple credentials.
Why does Web3Auth dispute the reported $6.01 million loss?
Web3Auth maintains that initial tracking aggregated both unauthorized thefts and authorized whitehat asset rescues under a single loss figure. Because the rescue maneuvers mirrored the technical paths used in the exploit, early analytics mislabeled funds preserved by Web3Auth and its partners as stolen assets.
What steps should affected Keplr users take immediately?
Users who created their Keplr wallets via social logins should avoid depositing new assets into those accounts, transfer existing funds to a newly generated secure seed-phrase or hardware wallet, avoid unverified third-party recovery schemes, and rely exclusively on verified communications published through official Keplr and Web3Auth channels.
