Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.
Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week.
Web3Auth then used the attacker’s own route to empty other at-risk wallets before the attacker got to them, it said. It moved that money, with help from the wallet maker, into recovery wallets for safekeeping. So an empty balance may mean the money was rescued, not stolen.
Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected, the wallet maker said. It has paused Google and Apple sign-in while it investigates.
What Affected Users Should Do
The wallet maker has given this user guidance for accounts created with Google or Apple login:
- Do not send new funds to the account.
- Do not re-import the account or recreate it anywhere.
- Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
- Trust updates only from the official accounts of the wallet maker and the login provider, and ignore direct messages or links that offer “recovery.”
Staked and locked assets are taking longer to secure. The wallet maker is also working with the login provider on a way for users to check whether their account was affected.
In the meantime, the login provider has published a recovery address list, which it says lets people tell its own transfers apart from possibly malicious ones.
It has also warned users not to assume that an unfamiliar destination address is linked to the attacker.
What Went Wrong
In an incident update, Web3Auth said a security issue in its own infrastructure affected certain wallets it provides inside the Keplr app.
Keplr went further, saying the flaw led to a “private key breach” for some users who signed in with Google or Apple. A private key is the secret code that approves payments from a wallet, so whoever holds it can move the money.
Neither company has said how the flaw worked, when the attacker first used it, or whether that route is now closed.
Where the Money Went
No dollar figure for the theft has come from either company. Josh Lee, a Keplr co-founder, gave an early estimate in his initial findings: about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited.
GoPlus, a Web3 security company, said in a security alert that at least about $1 million had been stolen. It did not explain how it reached that figure.
The rescued money went into what the login provider calls secure recovery wallets, on 11 blockchains in the Cosmos family and eight Ethereum-style chains.
Bitquery, a blockchain data firm, counted at least $6.01 million moving from more than 44,000 wallets into the recovery wallets by late last week. The firm first reported the transfers as theft. It has since issued a corrected analysis that treats them as the rescue, though it says it cannot check who controls the recovery wallets.
The first of these transfers came 21 minutes before the login provider’s first public notice, the firm’s data shows. Most of the wallets, 86%, were emptied after the wallet maker warned users.
The moved funds are safe, the login provider said in its recovery thread, and it is working with the wallet maker to return them to users. It has not said how or when.
Beyond Keplr
The login provider said the issue affects its services used by some other companies, but Keplr is the only one it has named. It paused its embedded wallet service, which other apps use to build wallets for their users. Its status page still shows its login service as down today.
Consensys, the company behind the MetaMask wallet, bought the login provider in June 2025. Its acquisition announcement said the deal would let MetaMask users create and recover wallets with social logins. The provider said its initial investigation found “no evidence that MetaMask users are impacted.”
