Keplr login flaw lets thief drain $6m from 44,000+ wallets
Why it matters
If you offer wallets that sign in with Google or Apple, this is the risk: the company running that login can become a single point of failure for thousands of customers' keys.
Post to XThe short version
A thief took at least $6 million from more than 44,000 Keplr crypto wallets on 6 and 7 November, according to research firm Bitquery. The wallets used Google or Apple sign-in, run by a Consensys-owned company called Web3Auth, and a flaw in its systems exposed the secret keys that control the money.
Here's what happened. Keplr is a popular crypto wallet, and some users signed up with their Google or Apple accounts instead of a recovery phrase. That sign-in was run by Web3Auth, which Consensys owns. A flaw in Web3Auth's systems exposed the private keys, the secret codes that move the coins, for some of those users.
Bitquery says the thief collected at least $6.0m from more than 44,000 wallets across eight blockchains in about 18 hours, starting on the evening of 6 November.
Web3Auth disclosed the problem that Friday and paused the service. From Saturday it began moving money out of still-exposed wallets itself, using the same route as the attacker. Its 12 recovery addresses held about $5.6m by Sunday, according to The Block, which reviewed the blockchain data. Web3Auth says those funds are safe and it is working with Keplr on getting them back to users.
Keplr co-founder Josh Lee estimated that about 20% of accounts using Google or Apple login were affected. Users with a recovery phrase or a hardware wallet were not, Keplr said. Web3Auth said it had found no sign that MetaMask users were hit.
Where this comes from
Written with AI from the sources above and checked against them before publishing. Here's how we work. This is news, not financial advice. Spotted a mistake? Tell us.
More on custody
- 9 November 2026Gnosis Pay breach leaks card numbers and addresses of crypto users
- 6 November 2026Standard Chartered and SBI invest in crypto theft insurer Soter
- 5 November 2026French bank Crédit Mutuel Arkéa named in $133m crypto theft
- 4 November 2026Binance's $6.3bn hack began with a fake job interview, it says