Keplr Wallet Breach Triggers $6 Million in Transfers Across Cosmos
Web3Auth vulnerability forces suspension of social logins as millions move in mysterious transfers.
1Social Login Vulnerability Exposed
On November 6, 2026, a security flaw within Web3Auth infrastructure compromised Keplr wallet accounts using Google and Apple logins. Keplr immediately disabled these authentication methods to prevent further unauthorized access. Chainapsis co-founder Josh Lee confirmed the vulnerability originated in third-party systems, rather than Keplr’s own internal software architecture or core code.
2Scope of Asset Transfers
Blockchain analytics firm Bitquery identified approximately $6.01 million in transfers across various Cosmos networks between November 6 and 7. Cosmos Hub accounted for $3.50 million of this total, followed by Osmosis at $1.04 million and Injective at $615,000. These figures reflect total observed movements rather than confirmed permanent theft.
3Protective Recovery Operations Complicate Data
The reported $6.01 million figure includes assets moved by white-hat hackers for protective custody. Keplr and Web3Auth confirmed that some recovery addresses overlap with collector wallets identified by investigators. Consequently, users may see empty balances because their funds were relocated for safekeeping, making the actual theft total currently impossible to verify.
4Impact on Staked Assets
The breach affected approximately 1.96 million staked ATOM tokens, which were moved without the standard 21-day unbonding period. Attackers and recovery teams utilized liquid staking mechanisms to convert positions into transferable share tokens. Additionally, roughly $251,000 in accumulated staking rewards were redirected during the rapid movement of these digital assets.
5Scale of Affected Accounts
Bitquery’s investigation tracked activity across 44,700 distinct private keys linked to the incident. While 86% of affected wallets on seven networks experienced transfers following the initial warning, the median loss per wallet was only $1.34. However, the largest single individual transfer reached approximately $325,000, highlighting the variance in user exposure.
6Security Design Trade-offs
This incident highlights the inherent risks of outsourcing private-key management to third-party authentication providers. While social logins simplify cryptocurrency onboarding for mainstream users, they create dependencies absent from traditional hardware-wallet arrangements. This breach serves as a stark reminder that convenience in wallet design often introduces a critical single point of failure.
7Recommended User Actions
Keplr advises users who utilized Google or Apple logins to avoid depositing additional assets immediately. Users should transfer remaining liquid holdings into newly secured wallets and ignore all unsolicited recovery offers. Staked assets may require additional processing steps, and users should monitor official channels for further instructions regarding their specific account status.
8Ongoing Investigation and Uncertainty
Neither Keplr nor Web3Auth has disclosed the precise technical cause of the vulnerability or a definitive reimbursement schedule. The industry remains in a state of uncertainty as investigators work to reconcile malicious withdrawals with protective transfers. Until the accounting mystery is resolved, the event remains a significant security scare for Cosmos.
Original article: Bitcoin News — Keplr Wallet Breach Triggers $6 Million in Transfers Across Cosmos