Keplr disables Google, Apple logins over unauthorized transaction reports

Keplr has temporarily disabled Google and Apple login for its multichain crypto wallet after receiving reports of unauthorized transactions from accounts created through those services, the company said in a statement on November 6, 2026.

Keplr and authentication provider Web3Auth are investigating, and neither has identified a cause, the number of affected accounts or any losses.

Keplr issues urgent warning to potentially affected users

Following the reports, Keplr issued specific instructions aimed at limiting further exposure while its technical investigation continues.

Users who established their accounts through Google or Apple login have been advised to stop transferring additional cryptocurrency into those wallets. The company also warned against importing or recreating potentially affected accounts elsewhere, emphasizing that users should avoid taking independent recovery actions until further instructions become available.

Another significant concern involves fraudulent recovery offers. Keplr cautioned users against trusting unsolicited direct messages, suspicious links or individuals claiming they can retrieve stolen cryptocurrency.

Instead, the company instructed affected account holders to obtain verified information exclusively through its official X account.

These precautions reflect a common problem during cryptocurrency security incidents. When users fear losing their assets, fraudulent actors frequently exploit the confusion by impersonating wallet developers, customer support representatives and recovery specialists.

Such schemes can create additional financial losses, particularly when victims are persuaded to disclose private keys, recovery phrases or other sensitive wallet information.

The Keplr exploit has not yet produced a publicly confirmed figure for the number of affected accounts or the total value of cryptocurrency potentially lost. The company has also not disclosed the specific blockchain networks or transaction addresses associated with the reports.

Until investigators establish the scope of the incident, users should treat unofficial recovery instructions with extreme caution.

Web3Auth suspends embedded wallet services amid investigation

The investigation extends beyond Keplr, as Web3Auth has separately acknowledged experiencing a security issue affecting services used by some third-party platforms.

In a November 6 statement, Web3Auth confirmed that it had temporarily suspended its embedded wallet service while investigating the problem.

“After an initial investigation, we’ve found no evidence that MetaMask users are impacted,” the company stated.

The clarification provides some reassurance to MetaMask users, although Web3Auth has not publicly identified every third-party platform potentially affected by the incident.

Embedded wallets allow applications to provide cryptocurrency wallet functionality without requiring users to go through the traditional process of setting up a standalone wallet. Social authentication options, including Google and Apple sign-in, can make blockchain applications more accessible to people unfamiliar with private keys and recovery phrases.

However, these arrangements introduce additional technical dependencies. When an application relies on an external authentication or wallet-infrastructure provider, a security problem involving that provider can potentially affect multiple connected platforms.

This makes the Keplr exploit investigation relevant beyond a single wallet application, particularly for developers building products around embedded wallet technology.

Neither Web3Auth nor Keplr has identified the precise vulnerability responsible for the reported transactions. It remains unclear whether the incident originated from compromised infrastructure, an authentication weakness or another security issue.

Importantly, the available statements do not establish that all Web3Auth-powered wallets have been compromised.

Different wallet security models raise questions about exposure

Keplr’s security documentation provides additional context about why the incident appears concentrated among social-login accounts.

According to its documentation, Google-login accounts use Web3Auth’s distributed key generation technology to create a private key. Unlike conventional wallet accounts, these users receive a hexadecimal-formatted private key rather than a standard 12- or 24-word recovery phrase.

The documentation further explains that the generated private key is encrypted and stored locally on the user’s device.

Traditional Keplr accounts operate differently. Users creating wallets through recovery phrases receive a mnemonic phrase that provides access to their cryptocurrency holdings. Hardware-wallet users, meanwhile, rely on dedicated devices to store and sign transactions.

These differences help explain Keplr’s initial assessment that recovery-phrase and hardware-wallet accounts have not been affected.

Nevertheless, the investigation must establish whether the reported security issue is limited to a particular authentication mechanism or involves a broader weakness in the underlying infrastructure.

The Keplr exploit also highlights the security considerations associated with convenience-focused wallet services. Although social logins can simplify onboarding, they require users to understand the additional services involved in creating and accessing their wallets.

For cryptocurrency holders, knowing how private keys are generated, stored and protected remains an important part of managing digital assets.

For now, both companies have avoided announcing a definitive explanation or recovery timeline.

Keplr has promised to communicate verified findings and subsequent instructions through its official channels as the investigation progresses. Until then, potentially affected users are being urged to follow the published security guidance and avoid unofficial recovery services.

The Keplr exploit investigation remains unresolved, leaving the cryptocurrency community waiting for clarity on the incident’s cause, potential financial impact and the measures required to restore confidence in the affected login services.