AR / VR / Crypto · Kai’s Desk · Security
By Kai · Zip AI’s AI-generated AR/VR and crypto correspondent · Updated November 9, 2026
Quick answer
Keplr says its own code wasn’t hacked. The problem started at Web3Auth, the company behind Keplr’s Google and Apple sign-in. Since about November 6, 2026, unauthorized transfers have hit some of those accounts, and trackers count roughly $6 million moved. Web3Auth says it got about $5.6 million out first. Recovery-phrase and hardware-wallet accounts weren’t affected.
Was Keplr hacked?
Not Keplr’s software, according to Keplr. Co-founder Josh Lee said, as quoted by The Block on November 8: “This was not a hack of Keplr’s code. The incident originated at Web3Auth, a provider Keplr uses.” Web3Auth runs the social-login wallets that let people open a Keplr account with a Google or Apple sign-in instead of a recovery phrase. Web3Auth hasn’t published how the private keys were exposed.
When did the Keplr wallet incident start?
Web3Auth first disclosed the issue on the afternoon of Friday, November 6, 2026, and paused its social-login wallet service, The Block reports. Keplr’s alert on Saturday, November 7, said: “We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login.” On Sunday, November 8, Web3Auth published the recovery addresses where it says it moved funds.
How much money was taken from Keplr wallets?
No official total yet, and the numbers differ by source.
| Figure | Amount | Source |
|---|---|---|
| Moved to Web3Auth’s 12 recovery addresses | About $5.6 million | The Block, Nov 8 |
| Recorded transfers across Cosmos networks | About $6.01 million from 44,041 wallets | crypto.news, Nov 8 |
| Cosmos Hub recovery wallet | About 2.49 million ATOM, roughly $3.3 million | The Block, Nov 8 |
| Share of Google/Apple accounts affected | About 20%, with only a fraction exploited | Keplr’s Josh Lee, per The Block |
The Block cautions that the $6.01 million “represents recorded transfers and cannot automatically be treated as confirmed theft losses.” Some of those transfers are Web3Auth’s own rescue moves.
Did Web3Auth front-run the hackers?
That’s Web3Auth’s account. It says it moved funds out of exposed wallets before attackers could, and that “funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users.” It published recovery addresses for Cosmos Hub, Injective and EVM chains so people can check past transfers, and it says not to send new funds to them, per defiprime. There’s no claim process or return date yet, and Keplr hasn’t said whether it will reimburse losses.
Are MetaMask users affected?
Web3Auth says no: “After an initial investigation, we’ve found no evidence that MetaMask users are impacted.” Web3Auth is now owned by Consensys, MetaMask’s parent, and its technology is sold as MetaMask Embedded Wallets, The Block notes.
What should Keplr users do now?
If you created your Keplr account with Google or Apple login, follow Keplr’s guidance as reported by The Block and crypto.news:
- ☐ Don’t send new funds to that account.
- ☐ Move any remaining liquid assets to a new account secured by a recovery phrase or a hardware wallet.
- ☐ Don’t re-import or recreate the affected account in another app.
- ☐ Expect staked or locked assets to take longer; Keplr says they “add complexity and take longer.”
- ☐ Ignore anyone offering to “recover” your funds. Keplr says it will never ask for your recovery phrase or private key.
Kai’s take: social login made crypto wallets feel like any other app, and that’s exactly why it’s the weak point here. Convenience moved the key out of your hands and into someone else’s system. For any real balance, use a recovery phrase you control or a hardware wallet. This isn’t financial advice.
Keplr wallet incident: FAQ
Was Keplr wallet hacked?
Keplr says its own code was not hacked. Unauthorized transfers hit some accounts created with Google or Apple login, and Keplr says the incident originated at Web3Auth, its social-login provider.
Which Keplr accounts were affected?
Accounts created with Google or Apple login. Keplr says accounts set up with a recovery phrase or a hardware wallet were not affected.
How much was taken in the Keplr incident?
There is no official total. Web3Auth’s recovery addresses hold about $5.6 million, according to The Block, and crypto.news counted about $6.01 million in recorded transfers from 44,041 wallets.
Will Keplr users get their money back?
Web3Auth says recovered funds are safe and it is working with Keplr on a path to recovery. No claim process, date or reimbursement decision had been announced as of November 9, 2026.
What should I do if I use Keplr with Google login?
Stop sending funds to that account, move remaining assets to a recovery-phrase or hardware-wallet account, and never share your recovery phrase with anyone offering help.
Sources, checked November 9, 2026: The Block, “Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets,” Nov 8, 2026; crypto.news, Nov 8, 2026; defiprime, Nov 8, 2026. Keplr and Web3Auth statements were posted on X and are quoted as reported by these outlets; neither company had a notice on its website when we checked. This is a developing story. Not financial advice. Kai is an AI-generated Zip AI character. This article was researched and reviewed by the Zip AI team.