Keplr has temporarily disabled Google and Apple sign-ins after receiving reports of unauthorized transactions from some wallets created through those social-login options. The Cosmos-focused wallet provider said it is investigating with Web3Auth, the third-party authentication service used in that account flow. The warning is limited to a specific account-creation route and does not establish that every social-login wallet was compromised.

Keplr narrows its initial warning

In its November 7 notice, Keplr said accounts created with a recovery phrase or connected through a hardware wallet are not affected under its initial assessment. Accounts created with Google or Apple login may be affected. That distinction matters because social-login wallets rely on a different key-management and authentication process from wallets restored directly with a recovery phrase or authorized by a hardware device. The assessment remains preliminary while the investigation continues.

Related reporting: CoinDCX Absorbs 15.99M USDT Loss After Legacy Wallet Sweep Fails

What affected users were told to do

Keplr advised users of Google- or Apple-created accounts not to send new funds to those wallets and not to re-import or recreate them elsewhere. It also told users to rely only on updates from its official account and ignore direct messages or links offering asset recovery. Those instructions are narrower than a general warning to all Keplr users: the company has not asked recovery-phrase or hardware-wallet users to migrate their accounts.

Web3Auth confirms a service-level incident

Web3Auth separately placed its Login Service into maintenance because of what it called a security incident. Its status page lists a maintenance window running from November 6 at 18:30 UTC to November 7 at 18:30 UTC and says precautionary measures are in progress. Web3Auth also said its embedded-wallet service was paused and that its initial investigation had found no evidence of impact to MetaMask users. That statement does not resolve the scope for Keplr or other third-party applications.

Unauthorized transactions do not yet size the loss

Reports of unauthorized transfers establish a potential asset-security event, but the available notices do not provide a verified victim count, total value, affected chains, transaction addresses or list of tokens. They also do not identify the technical entry point. It would therefore be premature to describe the incident as a compromise of Keplr's wallet code, a breach of Google or Apple accounts, or a failure affecting every Web3Auth customer. Each explanation would require different evidence and remediation.

Social-login convenience creates a distinct dependency

Social sign-in can make a crypto wallet easier to create because the user does not begin with the familiar recovery-phrase workflow. It also introduces an authentication dependency that differs from a locally protected phrase or hardware key. The current incident illustrates why users and application developers need to understand which service participates in account recovery, how signing authority is reconstructed and what happens when that service is unavailable or suspected of compromise.

What remains unresolved

Neither Keplr nor Web3Auth has published a final root-cause analysis, a confirmed loss figure, a compensation plan or a firm time for restoring social login. The maintenance window shown on a status page is not itself a promise that service will resume at its endpoint. The next meaningful update will be a jointly supported account scope, technical explanation and transaction-level reconciliation. Until then, users should follow Keplr's account-specific instructions and treat unsolicited recovery offers as hostile.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.