Keplr wallets lose at least $6.01M after Web3Auth social-login flaw

At least $6.01 million left Keplr wallets created through Google or Apple logins on November 6–7, 2026, according to tracing by on-chain analytics firm Bitquery cited by Crypto Briefing. The common factor is Web3Auth, the third-party key-management service Keplr embeds for social-login users — Web3Auth confirmed a vulnerability exposed private keys of some third-party users, but disputes the $6.01M figure, saying part of the outflow went to whitehat recovery wallets, not an attacker.

What happened

Bitquery's count, as reported by Crypto Briefing:

• 44,041 affected wallets on Cosmos-ecosystem chains, plus 7,603 on Injective.
• About $3.5 million drained from the Cosmos Hub alone, including roughly 1.96 million staked ATOM moved without the usual 21-day unbonding delay — a strong signal the mover controlled the key, not just a signature.
• 86% of drained funds on linked networks moved after Keplr's public warning on November 7.

Keplr co-founder Josh Lee estimated the breach affected about 20% of wallets created through Google and Apple logins, and said wallets secured with a seed phrase or a hardware signer showed no signs of compromise.

The mechanism: embedded Web3Auth, not seed phrases

Keplr's social-login flow does not give the user a 12/24-word recovery phrase — Web3Auth handles the key. The company shards a private key across the user's device, a social-login provider and a recovery method, using multi-party computation. The breach sits inside that path: Web3Auth confirmed "a vulnerability in its infrastructure exposed the private keys of some third-party users," paused its embedded wallet service on November 6, and on November 8 published verified recovery addresses for 11 Cosmos-based networks and 8 EVM chains. Users with a seed phrase or a Ledger/other hardware signer were never in the exposed path and are unaffected.

The exact technical cause has not been disclosed by either Keplr or Web3Auth as of this post.

Impact and the dispute over the number

Web3Auth's position: some of the flow Bitquery flagged as theft is in fact Web3Auth and its partners sweeping vulnerable balances to recovery addresses, using the same technical route as the initial attacks. On-chain, those movements look identical. Per Crypto Briefing, that is why the $6.01M headline is contested — the figure is the gross outflow from affected wallets, not the net amount sitting with an attacker.

Even taking the dispute at face value, the recovery is not clean:

• Staked ATOM moved past the 21-day unbonding window — that unbonding timer is the main defense a validator-set has against mass key compromise. If 1.96M ATOM really bypassed it, the security model for social-login staking is the story, not just the dollar figure.
• Injective's 7,603-wallet count is separate from the Cosmos ecosystem number, so the full scope is still being tallied.
• Bitquery's trace is a floor, not a ceiling: Lee himself said only a fraction of the 20%-affected cohort has been fully exploited so far.

What to watch

1. The post-mortem. Whether Web3Auth publishes the technical root cause and the window in which keys were exposed. Until it does, every social-login integration downstream (Keplr plus any other wallet that embeds Web3Auth) runs the same risk tomorrow it ran yesterday.
2. Reconciliation of the $6.01M figure. A side-by-side of Bitquery's wallet-level trace against Web3Auth's published recovery addresses will say whether the dispute is substantive or cosmetic.
3. Staking-unbonding behavior. If the 1.96M ATOM move really skipped the unbonding timer, that is a chain-level validator question, not a wallet question. Cosmos Hub governance may need to look at it.
4. Downstream integrations. Keplr is Web3Auth's most visible Cosmos consumer, but Web3Auth also powers EVM-side social logins in dozens of apps. Anyone using Google/Apple sign-in to a non-custodial wallet should assume the exposure window applies to them until proven otherwise.

Context

This is the second time in 2026 that an MPC-based social-login key-management product has produced a mass-scale user loss event on Cosmos infrastructure — the first was the Gravity Bridge signing-key compromise in May. The pattern is not wallet UI versus seed phrase: it is where the key actually lives when the user clicks "sign in with Google." Social logins remove one well-known attacker path (phishing a seed phrase) and introduce a different one (compromising the service that holds the shards). The Nov 6–7 incident is the clearest demonstration of that tradeoff this cycle, and it lands squarely in the Cosmos app-chain stack that leans most heavily on this UX choice.