Keplr Wallet Hack: $6 Million Drained From 44,000 Google and Apple Login Wallets — 7 Steps If You Signed In With Google

If you created your Keplr wallet by clicking "Sign in with Google" or "Sign in with Apple", your private key may have been exposed — and $6.01 million was drained from more than 44,000 wallets in about 18 hours before most victims even knew what was happening. The worst part: 86% of the victim wallets were emptied after Keplr had already issued its public warning. This article explains exactly what happened, who is safe, who is not, and the seven steps to take right now.

Keplr is the most widely used wallet in the Cosmos ecosystem, the gateway millions of people use to hold ATOM, OSMO, TIA and dozens of other Cosmos tokens. The breach did not come from Keplr's own wallet code. It came from Web3Auth, the third-party login provider that turns a Google or Apple account into a crypto wallet. That distinction matters — because it decides whether your money is at risk, and it is the detail most coverage gets wrong.

What Happened: The Keplr Wallet Hack in 60 Seconds

On November 6, 2026, a flaw in Web3Auth's infrastructure exposed the private keys of Keplr wallets created through social logins. Attackers used those keys to drain funds across eight Cosmos-based chains. Blockchain intelligence firm Bitquery traced approximately $6.01 million in transfers from more than 44,000 wallets, with the largest single loss reaching about $325,000. Keplr confirmed the incident in a security notice on November 7 and immediately suspended Google and Apple logins. Web3Auth paused its embedded wallet service the same day.

The drain ran for roughly 18 hours, starting late on Friday, November 6, and was still active on Cosmos Hub at 15:38 UTC on Saturday, November 7, when Bitquery's analysts finished their count. Cosmos Hub accounted for roughly $3.5 million of the traced transfers. Other affected networks included Osmosis, Celestia, Akash, Noble, Babylon, dYdX and Injective.

Here is the timeline as it unfolded:

Date / Time	What Happened
Nov 6, 2026 (late)	Web3Auth infrastructure flaw exposes private keys of social-login Keplr wallets; draining begins
Nov 6, 2026	Web3Auth pauses its embedded wallet service and puts its login service into maintenance
Nov 7, 2026, 04:38 UTC	Keplr issues public warning and suspends Google and Apple logins
Nov 7, 2026, 15:38 UTC	Drain still active on Cosmos Hub; Bitquery counts $6.01 million across 44,000+ wallets
Nov 8, 2026	Web3Auth publishes verified recovery addresses and says some flagged transfers were its own whitehat rescue

The single most alarming number in that timeline is not the $6.01 million. It is the 86%. According to Bitquery, 86% of the victim wallets were drained after Keplr's public warning went out at 04:38 UTC on November 7. Warnings only help people who see them in time — and in an 18-hour overnight drain, most victims were asleep, at work, or simply not watching crypto Twitter at 4:38 in the morning.

Who Is Affected — and Who Is Safe

The breach has a hard dividing line, and it is good news for a large share of Keplr users. Only wallets created through Google or Apple social logins are affected. If you set up your Keplr wallet with a 12- or 24-word recovery phrase, or with a hardware wallet, Keplr says you were not affected. Your keys were never in Web3Auth's system.

That is the crucial difference between this incident and a typical exchange hack. No exchange was hacked. No blockchain was broken. The weakness was in the convenience layer: the service that lets you create a wallet without writing down a recovery phrase. Social login is fast and frictionless — and that frictionlessness is exactly what made it dangerous. Your Google account became your private key, and when the service that translated one into the other failed, the key leaked.

If you are unsure how your wallet was created, check now: open Keplr and look at how you log in. If you sign in with Google or Apple and never wrote down a recovery phrase, treat your wallet as compromised until proven otherwise. If you log in with a recovery phrase or a hardware device, you can breathe — but read the checklist below anyway, because the scam wave that follows a breach like this targets everyone.

The Twist: Was It Theft — or a Rescue?

On November 8, the story took a turn that almost nobody expected. Web3Auth announced that some of the addresses blockchain investigators had flagged as attacker wallets were actually its own recovery wallets. The company said it had been running a whitehat operation with Keplr, moving funds out of vulnerable wallets before the attacker could reach them — using the same access path the attacker exploited. Some of those protective transfers were mistaken for additional theft.

Web3Auth published a list of verified recovery addresses covering eleven Cosmos networks — Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric — plus one address for eight EVM-compatible chains. The Cosmos Hub recovery wallet is linked to roughly $3.5 million, and the Osmosis recovery wallet to about $1.04 million. Both match addresses in Bitquery's investigation data.

Here is where it gets messy, and why you should not take any single number at face value yet:

• The $6.01 million figure counts transfers, not confirmed losses. Bitquery traced $6.01 million moving from victim wallets. But if some of those transfers were Web3Auth's own rescue operation, the true theft total is lower — nobody yet knows by how much.
• Some recovery addresses share a cryptographic key with wallets Bitquery tagged as attacker-controlled. That is the source of the confusion, and it is why even professional investigators initially read rescue transfers as theft.
• Web3Auth has not said how much it secured versus how much the attacker still controls. Recovered funds are safe, the company says, and it is working with Keplr on a way to return them — but there is no published process or timetable yet.
• There is still no full technical postmortem. Web3Auth has not publicly detailed the exact entry point that exposed the private keys, and it has not released a full list of other wallets that may have relied on the same vulnerable infrastructure.

The honest summary is this: at least some of the $6.01 million was genuinely stolen, and at least some of it was rescued by the whitehat operation. The split between the two is unknown. That uncertainty is itself a risk — because it creates the perfect cover for the next phase of this incident: fake recovery scams.

What Most People Get Wrong About This Hack

Three misconceptions are already spreading, and each one is dangerous in a different way.

Wrong: "Keplr was hacked, so all Cosmos wallets are unsafe." Keplr's own wallet code was not the entry point. The flaw was in Web3Auth's infrastructure, and it only affected wallets created through social logins. Recovery-phrase and hardware wallets were untouched. Cosmos itself was never compromised.

Wrong: "The $6 million was all stolen." As explained above, part of the traced total was Web3Auth's own rescue operation moving funds to safety. The real theft figure is lower than $6.01 million — but until Web3Auth publishes a full accounting, nobody can say how much lower.

Wrong: "If my funds are gone, Web3Auth will refund me." There are no reimbursement details available. Web3Auth says recovered funds are safe and that it is working on a return mechanism, but it has not promised compensation for funds the attacker actually took. Anyone who contacts you offering refunds, recovery services or "verified" help is almost certainly a scammer. Only follow updates from Keplr's and Web3Auth's official channels.

That last point deserves emphasis. After every major wallet breach, impersonators flood social media and direct messages offering to "recover" stolen funds. Web3Auth itself has warned users to rely solely on official channels. Never share your recovery phrase, private key or login credentials with anyone — no legitimate recovery process will ever ask for them. If you want to understand how these scam operations work at scale, read our investigation into the $15 billion crypto scam empire the US just sanctioned — the same playbook is being run on Keplr victims right now.

The 7-Step Checklist: What to Do Right Now

If you created a Keplr wallet with Google or Apple login, do these seven things today, in this order:

1. Stop sending funds to the affected wallet immediately. Keplr's own November 7 guidance says it plainly: do not deposit new funds into a social-login account. Every deposit lands in a wallet whose private key may be exposed.
2. Check whether your wallet was drained. Open Keplr and check your balances across every Cosmos chain you use — Cosmos Hub, Osmosis, Injective, Celestia and the rest. Check your transaction history for transfers you did not authorize, including staking claims moved without your approval.
3. Move any remaining liquid assets to a safe wallet now. Create a brand-new wallet secured by a written-down recovery phrase or a hardware wallet, and transfer whatever is left. Do this before anything else — the drain was still active hours after the warning, and exposed keys do not expire.
4. Understand that staked assets take longer to secure. Staked ATOM and other locked tokens cannot move instantly; unstaking has a waiting period. Keplr and Web3Auth have said staked and locked assets take longer to secure, so monitor them and do not assume they are safe just because they have not moved yet.
5. Verify recovery addresses only through official channels. Web3Auth has published verified recovery addresses, but scammers are already circulating fake ones. Only trust addresses published by Keplr or Web3Auth themselves — never one sent to you in a DM, a Telegram group or a reply to your post.
6. Do not trust anyone offering to recover your funds. No legitimate team will DM you first, ask for your recovery phrase, or charge an upfront "recovery fee". Report impersonators and block them.
7. Rebuild your setup the safe way. From now on, use a hardware wallet or a recovery-phrase wallet as your main store of value, and treat social-login wallets as convenient but expendable. Our guide to how to store Bitcoin safely in 2026 walks through the same seven-step setup — the principles apply to every coin, not just Bitcoin.

Why Social-Login Wallets Are the Weakest Link

This incident is not really about Keplr or Web3Auth. It is about a trade-off the whole crypto industry has been quietly making: convenience versus custody. A wallet created with "Sign in with Google" feels like any other app login. There is no recovery phrase to write down, no seed words to lose, no hardware device to buy. That is the selling point — and it is also the risk.

When you create a wallet with a recovery phrase, your private key is generated on your device and never leaves it. When you create one through a social login, a third-party service holds the machinery that reconstructs your key from your login. That service becomes a single point of failure. In this case, a flaw in Web3Auth's infrastructure exposed the keys of every social-login wallet built on it — not just Keplr's. Web3Auth has not released a full list of other wallets that relied on the same service, which means the blast radius may be wider than what we know today.

The lesson is not that social logins are evil. They are fine for small amounts and everyday use. The lesson is that they are not custody. If a wallet holds life-changing money, it should be secured by a recovery phrase you control, ideally on a hardware device — the same standard that protects Bitcoin holders from the exchange collapses and wallet drainer attacks we have covered before. Convenience is for spending money. Custody is for keeping it.

What Happens Next

Four things to watch in the coming days. First, Web3Auth's promised update to its recovery address list and, more importantly, a mechanism for returning rescued funds to their owners — without that, rescued money is safe but useless. Second, a full technical postmortem explaining exactly how the keys were exposed and whether other wallets using Web3Auth's infrastructure are affected. Third, any reimbursement decision for funds the attacker actually took — so far, none has been announced. Fourth, the scam wave: fake recovery sites, impersonator accounts and phishing DMs are already circulating, and they will intensify as victims search for answers.

There is also a bigger question hanging over the Cosmos ecosystem. Keplr is the default wallet for Cosmos, and trust in it is trust in the ecosystem itself. The fact that recovery-phrase and hardware wallets were untouched limits the damage, but the incident will push more users toward self-custody — and it should. Every wallet breach that ends with "your keys were held by a third party" is the same lesson, taught again.

For the wider market, the timing is notable. Bitcoin is trading near $75,900, down about 2.7% on the week, with the Fear and Greed Index at 28 — firmly in fear territory — and spot Bitcoin ETFs recording $1.28 billion in outflows in the week of November 2–6. In a fearful market, security incidents hit harder, because nervous holders are more likely to sell first and ask questions later. If you are weighing whether this changes anything about your own holdings, our five-test framework for deciding whether to buy, wait or walk away is a calmer way to make that call than a headline.

FAQs

Was my Keplr wallet hacked?

Only if you created it with a Google or Apple social login. Wallets created with a 12- or 24-word recovery phrase or a hardware wallet were not affected, according to Keplr. If you used social login, check your balances and transaction history immediately and move any remaining funds to a new recovery-phrase or hardware wallet.

How much was stolen in the Keplr hack?

Bitquery traced about $6.01 million in transfers from more than 44,000 wallets. But that figure counts transfers, not confirmed theft — Web3Auth says some of the flagged transfers were its own whitehat rescue operation moving funds to safety. The true theft total is lower than $6.01 million, but Web3Auth has not yet disclosed the split.

Is Keplr safe to use now?

Keplr has suspended Google and Apple logins, and Web3Auth has paused its embedded wallet service while it investigates. Recovery-phrase and hardware wallets were never affected and remain safe to use. Do not create a new social-login wallet or deposit funds into an existing one until Keplr and Web3Auth confirm the issue is fully resolved.

Will I get my stolen crypto back?

Unknown. Web3Auth says funds it moved into verified recovery wallets are safe and that it is working with Keplr on a way to return them, but it has not published a process or timetable. There are no reimbursement details for funds the attacker actually took. Be extremely wary of anyone offering to recover your funds — those are almost certainly scams.

What is Web3Auth and why did it affect Keplr?

Web3Auth is a third-party login provider that lets apps create crypto wallets from social accounts like Google and Apple. Keplr used Web3Auth's embedded wallet service for its social-login option. A flaw in Web3Auth's infrastructure exposed the private keys of those wallets. The issue was in Web3Auth's systems, not in Keplr's own wallet code.

How can I protect my crypto wallet from hacks like this?

Use a hardware wallet or a recovery-phrase wallet for any meaningful amount, write your recovery phrase down on paper or metal and store it offline, never share it with anyone, and treat social-login wallets as convenient but expendable. Enable every security feature your wallet offers, verify addresses only through official channels, and never trust DMs offering recovery help.

Conclusion

The Keplr hack is a $6.01 million lesson in a single sentence: convenience is not custody. A wallet you create with one click is a wallet someone else can open with one flaw. The 44,000 victims did nothing careless — they used a feature their wallet offered, exactly as designed. The system failed them, and 86% of them were drained after the warning had already gone out.

If you used Google or Apple login with Keplr, act today: stop depositing, check your balances, move what is left to a wallet you control with a recovery phrase or a hardware device, and ignore every stranger offering to help you recover it. The money that Web3Auth rescued may come back. The money the attacker took probably will not. What you can still control is everything that remains — and the setup you use from now on.

Sources: Crypto.news, BeInCrypto, KuCoin News, CryptoCoinShow, Cosmos Hub Forum. All figures are as reported by those sources on November 8, 2026; the theft-versus-rescue split is still unconfirmed.