SECURITY ALERT
The recovery phrase was never written down. That was the selling point.
Keplr, a widely used wallet for Cosmos-based blockchains, says it has received reports of unauthorised transactions on some accounts created with Google or Apple login, according to a post on its official X account at 04:38 UTC on Saturday 7 Nov.
Google and Apple login are paused for now, the wallet says.
Keplr says it flagged the reports to Web3Auth, the company behind that login option, and has been working with it on the investigation.
Based on its initial assessment, wallets created with a recovery phrase or a hardware wallet are not affected, Keplr says.
The timeline
- 21:13 UTC, Fri 6 Nov: Web3Auth says it is aware of “a security issue affecting Web3Auth’s services used by some third parties” and has temporarily paused its embedded wallet service. It adds that it has found no evidence that MetaMask users are affected, and that it will share confirmed details and any steps users need to take.
- 04:38 UTC, Sat 7 Nov: Keplr confirms the unauthorised transactions on some social-login accounts and pauses Google and Apple sign-in.
Web3Auth was bought by Consensys, the company behind MetaMask, in June 2025, The Block reported at the time.
The service lets apps create embedded wallets that apps create for their users behind a familiar sign-in button, without showing them a recovery phrase.
So which part of that chain failed?
What is not known yet
Neither company has said how the accounts were accessed.
Neither has said how many accounts were affected, how much was taken or on which chains.
Figures circulating on social media have not been confirmed by Keplr or Web3Auth, and we have not used them.
Web3Auth has not named the other third-party services that use the paused embedded wallet product.
The Defiant also reported Keplr’s pause.
A paused login does not freeze anything already on-chain.
That is why Keplr’s advice matters more than the cause, for now.
Protect yourself
- If you created your Keplr wallet with Google or Apple login, do not send new funds to it while the investigation runs, Keplr says.
- Do not re-import or recreate that account in any other app, Keplr says.
- Trust updates only from Keplr’s official X account. Ignore direct messages or links that offer “recovery”; that is exactly where the second wave of losses usually comes from.
- If you use any other app that offers sign-in with Google, Apple or email instead of a recovery phrase, check its official channels for whether it relies on Web3Auth before moving funds.
Related: Why the recovery phrase is the master key
Like Gnosis Pay’s card-system breach this week, the weak point was a service sitting beside the wallet, not the chain itself.
If the key was never in the user’s hands, who exactly was holding it?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.