Web3Auth Vulnerability Exposes Some Keplr Social-Login Wallets
Web3Auth disclosed a security issue in its infrastructure that exposed certain Keplr cryptocurrency wallets created through Google or Apple sign-in. Keplr said the flaw resulted in a private-key breach for some users, enabling an attacker to move funds from affected wallets. In response, Web3Auth used the same route to transfer assets from other at-risk wallets into secure recovery wallets before they could be taken.
The companies have not disclosed the technical mechanism, the time of the first exploitation, or whether the attack path has been fully closed. Keplr has paused Google and Apple login while it investigates. Wallets created with a recovery phrase, including the standard 12- or 24-word backup, or secured with a hardware wallet are not affected, Keplr said.
Rescue transfers complicate balance checks
An empty balance does not necessarily mean the funds were stolen. Web3Auth said it moved funds with Keplr’s assistance into recovery wallets for safekeeping and is working on a process to return them to users. It published a list of recovery addresses so users can distinguish its transfers from potentially malicious activity.
Bitquery initially described the transfers as theft but later corrected its analysis, characterising them as a rescue operation. The blockchain-data firm counted at least $6.01 million moved from more than 44,000 wallets by late last week. Its data showed the first transfer occurred 21 minutes before Web3Auth’s first public notice, and 86% of the wallets were emptied after Keplr warned users. Bitquery also noted that it cannot independently verify who controls the recovery wallets.
GoPlus, a Web3 security company, estimated that at least about $1 million had been stolen, without explaining its methodology. Keplr co-founder Josh Lee gave an early assessment that about 20% of accounts using Google or Apple login were affected, while only a fraction of those appeared to have been exploited. Neither company has provided a confirmed aggregate loss figure.
Scope reaches multiple blockchain networks
Web3Auth said its recovery operation covered 11 blockchains in the Cosmos family and eight Ethereum-style chains. Staked or locked assets are taking longer to secure. The provider also said the underlying issue affects services it supplies to some other companies, but Keplr is the only named customer so far.
Web3Auth has paused its embedded wallet service, which applications use to create wallets for users, and its status page continued to show the login service as unavailable. Consensys acquired Web3Auth in June 2025 as part of plans to support wallet creation and recovery through social logins in MetaMask. Web3Auth said its initial investigation found no evidence that MetaMask users were affected.
Actions for affected wallet holders
Keplr advises users with Google- or Apple-created accounts not to deposit new funds into those accounts and not to re-import or recreate them elsewhere. Users should move funds that are neither staked nor locked to an account protected by a recovery phrase or hardware wallet. They should also treat unsolicited recovery messages and links as suspicious, relying only on official Keplr and Web3Auth communications.
For businesses holding digital assets, the incident is a practical reminder to identify wallets dependent on social-login custody, separate accessible funds from accounts under investigation, and maintain recovery-phrase or hardware-wallet controls for operational balances.