Reporting · technology
Keplr wallet drain linked to Web3Auth login flaw, over $6 million tied
A hack of Keplr wallet users who logged in with Google or Apple affects eight Cosmos-based chains, with over $6 million tied to the drain by Bitquery.
Quick take
- Keplr users who signed in with Google or Apple accounts were hit by a hack, according to BeInCrypto.
- Bitquery ties over $6 million to the drain, counts about 44,700 affected wallets, and puts the largest single loss near $325,000.
- Web3Auth is working with Keplr on fund returns and has published verified recovery addresses across multiple chains.
BeInCrypto reported on November 8, 2026 that Bitquery counts about 44,700 Keplr wallets hit after users signed in with Google or Apple accounts. Web3Auth, which supplies the embedded wallet service involved, says the flagged addresses are its own recovery wallets and that it traced the flaw to its own infrastructure. The company paused that service on November 6, and Keplr has since disabled Google and Apple sign-ins.
Bitquery ties more than $6 million to the drain and counts about 44,700 affected Keplr wallets. The losses span eight Cosmos-based chains, and Bitquery puts the largest single loss at about $325,000. Taken together, the disclosures cover the drain, the affected wallets, the chains involved and the planned returns.
Web3Auth says a whitehat operation moved the vulnerable funds, and it has published verified recovery addresses on multiple chains. It is also working with Keplr on returning funds.
Sources
Machine-written from the publishers’ reports and checked against them · How Dextape writes