The Keplr wallet hack only touches accounts that were set up with a Google or Apple login. Keplr paused those logins on November 6 after users reported coins leaving their wallets. The flaw sits with Web3Auth, the company behind those logins. Wallets made with a recovery phrase or a hardware wallet are not affected, Keplr says.

Key facts

  • Who: Keplr wallet users who signed up with Google or Apple; login provider Web3Auth
  • What: A flaw at Web3Auth exposed private keys for some of those accounts
  • When: Keplr paused Google and Apple login on November 6, 2026
  • How much: Web3Auth moved about $5.6 million into 12 recovery addresses; theft estimates range from about $1 million to $6 million
  • Source: The Block and CryptoTicker

If you opened a Keplr wallet by tapping "Continue with Google" or "Continue with Apple," your account may have been exposed. Keplr, a popular wallet for the Cosmos family of coins, paused both login options on November 6 after users reported transactions they didn't make, CryptoTicker reported. Web3Auth, the company that runs those logins, says the flaw is in its own systems.

Wallets set up with a recovery phrase or a hardware wallet are not affected, Keplr says. A recovery phrase, often called a seed phrase, is the list of 12 or 24 words that can restore a wallet.

A rescue, then confusion

Web3Auth says it moved coins out of exposed wallets before attackers could, into 12 recovery addresses. Those held about $5.6 million on November 8, The Block reported. So an empty Keplr account does not always mean theft. The coins may sit in one of those recovery addresses.

Some coins were stolen, though, and nobody agrees how much. Security firm GoPlus put it at about $1 million or more. Data firm Bitquery tied about $6 million to an attacker across more than 44,000 wallets, FinanceFeeds reported. Reports put the share of exposed social-login accounts near 20%.

What's still unknown

Neither company has explained how the keys leaked. There's no claim form yet and no date for getting coins back or turning logins back on, Cryptonews reported. Web3Auth says it is working with Keplr on a way back for users.

If you used Google or Apple login on Keplr

  • Don't add new money to that account, and don't import it into another wallet app for now.
  • Move what's left to a wallet made with a recovery phrase you control, or a hardware wallet. Here's how to store a seed phrase.
  • Ignore anyone who offers to "recover" your coins. Wait for Keplr's own channels. This is when recovery scams and fake wallet support show up.

Sources: The Block, Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets (November 8, 2026), CryptoTicker, Keplr Wallet halts Google and Apple login after Web3Auth flaw drains accounts (November 2026), FinanceFeeds, Web3Auth's $5.6M Keplr rescue clouds $6M theft estimate (November 2026), Cryptonews, Twelve recovery wallets later, Keplr users still have no explanation for the key breach (November 2026).