Security vulnerability ffecting Web3Auth, a service used by the Keplr cryptocurrency wallet for Google and Apple sign-ins, has been exploited by attackers to gain access to users’ wallets and steal digital assets.
The incident affected some users who created their Keplr wallets through their Google or Apple accounts. Both Keplr and Web3Auth confirmed the security breach, with the latter subsequently moving funds from other vulnerable wallets into recovery wallets to prevent attackers from accessing them.
Web3Auth said it used the same transfer route available to the attacker to move funds from exposed accounts before they could be compromised. The assets were transferred with assistance from Keplr and placed in designated recovery wallets.
Consequently, users who discover that their wallet balances have dropped to zero may find that their funds were transferred to safety rather than stolen.
Keplr clarified that wallets created using recovery phrases or hardware wallets were not affected. However, it has temporarily suspended Google and Apple sign-in while investigations continue.
What Affected Users Should Do
Keplr has issued security instructions for users who created their accounts through Google or Apple authentication.
Affected users have been advised not to deposit additional funds into the accounts or attempt to re-import or recreate them on other platforms.
They have also been instructed to transfer any assets that are not staked or locked into a different wallet secured with a recovery phrase or hardware wallet.
The company warned users to obtain updates exclusively from its official communication channels and those of Web3Auth. It also cautioned against responding to unsolicited direct messages or clicking links from individuals claiming to offer assistance with recovering stolen cryptocurrency.
Securing staked and locked assets has reportedly proved more complicated, with both companies working on measures to protect those funds. Keplr and Web3Auth are also developing a system that will allow users to determine whether their accounts were affected.
Meanwhile, Web3Auth has published a list of recovery wallet addresses to help users distinguish legitimate security transfers from potentially suspicious transactions.
The company warned that users should not automatically assume that an unfamiliar destination address belongs to the attacker, as some addresses were used during the emergency transfer of funds.
How the Security Breach Happened
In an incident update, Web3Auth acknowledged that a security weakness in its infrastructure affected certain wallets embedded within the Keplr application.
Keplr described the incident as a private-key compromise involving some accounts created through Google and Apple sign-in.
A private key is a confidential cryptographic credential that authorises transactions from a cryptocurrency wallet. Anyone who gains control of it may be able to transfer the wallet’s assets without the owner’s permission.
However, neither company has disclosed the technical details of the vulnerability, when the attackers first exploited it or whether the security weakness has been completely eliminated.
Millions of Dollars Moved Into Recovery Wallets
Although neither company has provided an official estimate of the total amount stolen, preliminary assessments indicate that a significant number of accounts were exposed.
Josh Lee, a co-founder of Keplr, disclosed in his initial findings that approximately 20 per cent of accounts created through Google and Apple authentication were affected. However, he indicated that only a portion of those accounts appeared to have been actively exploited.
Blockchain security firm GoPlus separately estimated that attackers had stolen at least $1 million, although it did not explain the methodology behind its calculation.
The emergency transfers carried out by Web3Auth involved recovery wallets operating across 11 blockchains within the Cosmos ecosystem and eight Ethereum-compatible networks.
Blockchain analytics company Bitquery initially identified transactions involving at least $6.01 million transferred from more than 44,000 wallets into the designated recovery addresses.
The firm initially interpreted the transactions as evidence of theft but later published a revised analysis identifying them as emergency fund transfers intended to protect users’ assets.
However, Bitquery noted that it could not independently verify who controls the recovery wallets.
Its analysis also revealed that the first recorded transfers occurred approximately 21 minutes before Web3Auth issued its initial public announcement about the incident.
About 86 per cent of the affected wallets were emptied after Keplr had issued its warning to users.
Web3Auth has maintained that the transferred assets remain safe and said it is working with Keplr to return the funds to their rightful owners. However, it has not announced a specific timeline or explained the process for restoring access to the recovered assets.
Other Cryptocurrency Platforms Could Be Affected
The incident may extend beyond Keplr, as Web3Auth disclosed that the security issue affected services it provides to other companies.
However, Keplr remains the only affected platform publicly identified by the provider so far.
Web3Auth has temporarily suspended its embedded wallet service, which other applications rely on to create and manage cryptocurrency wallets for their users. Its service status page also continued to indicate that its login service was unavailable at the time of the report.
The incident has also drawn attention to Web3Auth’s connection with Consensys, the blockchain technology company behind MetaMask.
Consensys acquired Web3Auth in June 2025 as part of efforts to improve wallet creation, account recovery and user experience across its ecosystem.
The acquisition was expected to allow MetaMask users to create and recover cryptocurrency wallets through social login options.
However, Web3Auth said its preliminary investigation had found no evidence that MetaMask users were affected by the security incident.
The investigation remains ongoing, while Keplr and Web3Auth continue working to secure vulnerable accounts, protect transferred assets and establish a process for returning recovered funds to affected users.