Recent incidents have revealed that users of the Keplr crypto wallet who utilize their Google or Apple accounts for login have experienced unauthorized withdrawals. This breach stems from a vulnerability within the Web3Auth authentication service utilized by Keplr.

Incident Overview

Both Keplr and its authentication provider, Web3Auth, confirmed that a security flaw allowed an intruder to gain access to the wallets linked to these sign-in methods. It was reported that, upon discovering malicious access, Web3Auth acted quickly to secure other potentially at-risk wallets by transferring affected funds into so-called recovery wallets.

Users who created their wallets using a recovery phrase or who employed hardware wallets were not impacted by this breach. In light of the ongoing investigation, the Google and Apple login functionalities have been temporarily disabled.

Guidance for Affected Users

In response to this incident, the wallet provider has issued the following recommendations for users who signed up using their Google or Apple accounts:

• Do not deposit additional funds into the affected accounts.
• Avoid re-importing or recreating the accounts elsewhere.
• Transfer any non-staked or non-locked assets to an account secured with a recovery phrase or a hardware wallet.
• Only trust updates from official channels and avoid unsolicited recovery messages or links.

Funds that are staked or locked are under additional scrutiny, and the wallet provider is collaborating with Web3Auth to assist users in verifying whether their accounts have been compromised.

Understanding the Breach

Web3Auth released an update confirming that some of its infrastructure vulnerabilities had led to a breach affecting private keys associated with certain Google and Apple sign-ins. A private key acts as a critical authorization element for wallet transactions, meaning that whoever obtains it can control and transfer the held assets.

As of now, the exact method of attack remains undisclosed, and it is unclear when the breach first occurred or if the vulnerability has been entirely resolved.

Estimation of Losses

Neither Keplr nor Web3Auth has provided an official figure for the total amount stolen. However, preliminary estimates suggest that approximately 20% of accounts using Google and Apple sign-in were affected, with an even smaller percentage experiencing asset exploitation. Security firm GoPlus noted that losses could be around $1 million, but specific details on this estimate were not disclosed.

Analysis from Bitquery indicated that over $6 million was transferred into recovery wallets within a short time frame, with these transfers initially being misinterpreted as theft before being classified as secure recovery actions. The login provider confirmed that these funds are safe and are in the process of being returned to affected users.

Wider Implications

While the security flaw primarily impacted Keplr, Web3Auth indicated that its services are also utilized by other companies. However, Keplr remains the only specifically named affected outlet at this time. The authentication provider has paused its embedded wallet services while it continues its investigation into the breach.

Since June 2025, Web3Auth has been a subsidiary of Consensys, the parent company of MetaMask. An initial review by Web3Auth found no signs that MetaMask users were impacted by this breach.