Keplr Pauses Google and Apple Logins as Web3Auth Breach Drains Cosmos Wallets
On-chain investigators traced more than $6 million leaving thousands of Cosmos wallets, and recovery wallets were verified on November 8.
Key Takeaways
- A Web3Auth vulnerability let attackers reach private keys behind Keplr wallets created with Google or Apple login.
- On-chain investigators traced more than $6 million leaving thousands of Cosmos wallets.
- Keplr paused Google and Apple logins on November 7, 2026 and said seed phrase and hardware wallets are not affected.
- Web3Auth verified recovery wallets on Cosmos Hub, Osmosis, Celestia and other chains on November 8, 2026.
Attackers drained more than $6 million from thousands of Cosmos (ATOM) wallets after a vulnerability in Web3Auth exposed private keys behind social logins. The Keplr wallet paused Google and Apple logins on November 7, 2026, the day it started receiving reports of unauthorized transactions.
How the Cosmos Wallet Drain Happened
Keplr used Web3Auth as the key management service for wallets created from a Google or Apple account. The vulnerability in that service let attackers access private keys for some of these social-login wallets. Keplr said it contacted Web3Auth immediately and confirmed that wallets created with a recovery phrase or a hardware wallet are not affected. On-chain investigators traced more than $6 million across thousands of Cosmos wallets, according to crypto.news. The breach sits in the login layer, not in the consensus code of the Cosmos networks themselves.
Which Keplr Accounts Are Affected
Only wallets created with Google or Apple login may be affected. Some of these accounts already show reduced or zero balances because a whitehat recovery effort moved assets to safe wallets before attackers could take them. On November 8, Web3Auth published verified recovery addresses for Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, Agoric and an EVM address. Keplr warned that only updates from its own account and the Web3Auth account should be trusted. The recovery addresses were published in a thread quoting Web3Auth on November 8, 2026. Keplr said it contacted Web3Auth as soon as the first reports arrived.
What the Pause Means for the Cosmos Ecosystem
Google and Apple login remain paused in Keplr while the two teams work through the incident. The affected accounts span the Cosmos ecosystem, from Cosmos Hub to Osmosis and Celestia, because one login can control wallets on many connected chains. Traders can follow ATOM through the incident window on the Cosmos price chart.
Frequently Asked Questions
What Happened in the Cosmos Wallet Drain?
A vulnerability in Web3Auth let attackers reach private keys behind Keplr wallets created with Google or Apple login. On-chain investigators traced more than $6 million leaving thousands of Cosmos wallets.
When Did the Keplr Wallet Drain Start?
Keplr said it started receiving reports of unauthorized transactions on November 7, 2026, and paused Google and Apple logins the same day.
Are Seed Phrase and Hardware Wallets Affected?
No. Keplr said wallets created with a recovery phrase or a hardware wallet are not affected by the Web3Auth breach.
What Is Web3Auth?
Web3Auth is the key management service Keplr used to create wallets from Google and Apple logins. The breach affected its social login keys, not the Cosmos networks themselves.
Has Any of the Drained Crypto Been Recovered?
A whitehat recovery was under way on November 8, 2026, with assets from affected Keplr wallets moved to recovery addresses verified by Web3Auth across Cosmos Hub, Osmosis, Celestia and other chains.
Sources
- Keplr announcement of unauthorized transactions on Google and Apple login accounts · Keplr on X
- Keplr halts Google, Apple logins as $6M wallet drain hits Cosmos · crypto.news
Prices and market data: Coinranking.
