Keplr Google/Apple-login wallets drained after Web3Auth security incident; social login paused

Summary

Keplr reports unauthorized transactions from some Keplr accounts created with Google or Apple social login, which rely on Web3Auth's login and key-management infrastructure. Web3Auth acknowledged a security issue affecting its services used by some third parties, paused its embedded wallet service, and placed its Login Service into maintenance mode. Keplr has paused Google/Apple login. Keplr co-founder Josh Lee states the incident originated at Web3Auth, not in Keplr's code.

Affected

• Keplr accounts created with Google or Apple login (Web3Auth-backed). Keplr's early estimate is that about 20% of these accounts are affected, and that only a fraction of those have actually been exploited.
• Not affected per Keplr's initial assessment: Keplr wallets created with a recovery phrase or a hardware wallet.
• Web3Auth states it has found no evidence that MetaMask users are impacted.
• No fix available at time of publication; the affected login services are paused.

Impact

Funds were moved out of affected social-login accounts without authorization; exploitation in the wild is confirmed by Keplr. Neither Keplr nor Web3Auth has published a root cause, total loss figure, list of affected networks, or attacker addresses at the time of publication. Media reports that the affected assets are in the Cosmos ecosystem; loss estimates circulating in the press are unverified by Keplr or Web3Auth. Media also report that Web3Auth and partners made protective recovery transfers from at-risk accounts, so unfamiliar outgoing transfers are not necessarily attacker activity; no indicators are listed in this advisory for that reason.

Recommended actions

• If you created a Keplr account with Google or Apple login: do not send new funds to it and do not re-import or recreate it anywhere (Keplr guidance).
• Once guidance is published, move remaining assets to a wallet secured by a recovery phrase or a hardware wallet.
• Trust updates only from Keplr's official X account (@keplrwallet); ignore DMs or links offering "recovery".
• Projects integrating Web3Auth embedded wallets or social login should follow Web3Auth's status page and official channels and review exposure.

Source & attribution

This 0xCERT advisory summarises disclosures by Keplr (https://x.com/keplrwallet/status/2118926087615045807), Keplr co-founder Josh Lee (https://x.com/dogemos/status/2118984142151196677), and Web3Auth (https://x.com/Web3Auth/status/2118814067359969745, https://status.web3auth.io/events/maintenance/461); the incident was also listed by DeFiLlama. Details may change; refer to the original sources for the authoritative record.