Keplr Suspends Social Logins After Unauthorized Wallet Activity; $6 Million in Transfers Later Linked to Recovery Wallets

Keplr suspended Google and Apple sign-ins after unauthorized transactions hit some wallets, while more than $6 million in transfers across Cosmos-linked networks were later traced to addresses identified as recovery wallets.

Keplr paused the logins late Nov. 6 after detecting unauthorized transactions on some social-login wallets. Keplr co-founder Josh Lee said the incident originated at Web3Auth, the embedded-wallet provider used for those sign-ins.

At least $6.01 million in assets moved to two receiving addresses across seven Cosmos networks and Injective. Transfers were counted through 10:38 a.m. ET Nov. 7 (15:38 UTC), with dollar values based on spot prices at 10:27 a.m. ET (15:27 UTC). The estimate covered about 44,700 unique wallet keys, not a verified count of users.

On Nov. 8, Keplr and Web3Auth identified the two addresses as recovery wallets and published verified recovery addresses. The $6.01 million is a transfer tally, not a confirmed theft amount. Neither company has disclosed how much the original attacker stole or the final amount returned to users. Keplr said accounts using recovery phrases or hardware wallets were unaffected.