Web3Auth Restores Keplr Social-Login Wallets: What Affected Users Should Do

Quick answer: Web3Auth said on 14 November 2026 that login and wallet access are restored for existing users after the key exposure that hit Keplr wallets created with Google or Apple sign-in. Funds it moved out of exposed wallets are held in custody, and a return process will be announced "in the coming days". Seed-phrase and hardware wallets were not affected.

What happened

On 6 November 2026, Web3Auth, the embedded-wallet provider owned by Consensys and marketed as MetaMask Embedded Wallets, paused its service after a flaw in its infrastructure exposed the private keys of some wallets created through social login. The most visible victims were users of Keplr, the popular Cosmos wallet, who had created accounts with "Sign in with Google" or "Sign in with Apple".

Keplr suspended Google and Apple logins. Keplr co-founder Josh Lee said the incident was not a hack of Keplr's code and originated at Web3Auth, according to crypto.news. Lee estimated that about 20% of Keplr's Google and Apple login accounts were affected, while only a fraction of those were actually exploited.

Wallets created with a 12- or 24-word recovery phrase, or connected to a hardware wallet, were not affected, because their keys never depended on Web3Auth's key infrastructure.

How much was taken, and the rescue dispute

Blockchain data firm Bitquery traced about $6.01 million in transfers out of roughly 44,000 wallets across Cosmos networks including Cosmos Hub, Osmosis, Celestia, Akash, Noble, Babylon and dYdX, plus thousands of addresses on Injective, according to crypto.news.

Web3Auth disputes that this was all theft. As reported by The Block, the company says it front-ran the attacker by moving assets out of exposed wallets into recovery addresses, and that those rescue transfers followed the same on-chain routes, so outside analysts counted them as stolen. On 8 November its recovery addresses held about $5.6 million, including roughly 2.49 million ATOM on Cosmos Hub.

Some staked ATOM was moved using staking-share tokenization, which skips the usual 21-day unbonding period. Keplr warned that affected accounts may show a reduced or empty balance because of rescue transfers, and that staked or locked assets will take longer to recover.

The 14 November update

According to TokenPost, Web3Auth published an update on 14 November 2026:

• Login and wallet access is restored for existing users on its Plug and Play and Single Factor Auth (SFA) SDKs, which power Torus Wallet and embedded wallets inside third-party apps such as Keplr.
• New SFA registrations are temporarily restricted.
• Rescued funds are held in secure custody, rescue operations are ongoing, and the process for returning assets will be announced in the coming days.
• Web3Auth SDK v9 and earlier are deprecated; developers must upgrade to v10 or v11. New registrations on the Legacy network are expected to resume by 23 November.

Restored access does not mean your assets are back. If Web3Auth moved your funds, they remain in its custody until the return process is published.

Who is affected

• Keplr users who created wallets with Google or Apple login: potentially affected. Check your balances and transaction history.
• Users of other apps that embed Web3Auth (including Torus Wallet): check the app's own announcements.
• Keplr users with a recovery phrase or hardware wallet: not affected by this incident.
• Developers integrating Web3Auth: must upgrade to SDK v10 or v11.

How to check your wallet

Step 1: Identify how your wallet was created

In Keplr, a social-login account shows a Google or Apple sign-in rather than a recovery phrase. If you never wrote down a recovery phrase when creating the wallet, it was probably a social-login wallet.

Step 2: Review outgoing transfers

Copy your address for each Cosmos network you use and search it on a block explorer such as Mintscan. Look for outgoing transfers from 6 November onward that you did not make.

Step 3: Compare against official recovery addresses

Web3Auth published recovery addresses for 11 Cosmos networks and 8 EVM chains. Compare the destination of each unexpected transfer with the list on Web3Auth's official channels. Only rely on the list from Web3Auth's own website or verified account, never from a reply or direct message.

Step 4: Note staked positions

If you had staked ATOM or other tokens, record your validator, amounts and any tokenized staking shares. Staked and locked assets are expected to take longer to return.

Step 5: Wait for the official return process

Web3Auth says the return process will be announced in the coming days. Follow Web3Auth's and Keplr's official websites and verified accounts. Do not sign any transaction or message that claims to "claim" or "unlock" rescued funds unless it is linked from an official source you have verified.

How to secure your funds going forward

• Move remaining liquid assets from a social-login wallet to a new wallet secured by a recovery phrase you write down offline, or to a hardware wallet.
• Don't send new funds to the old social-login address.
• Revoke unnecessary permissions. On EVM chains use a reputable approval checker; on Cosmos chains, review authz grants and feegrants in your wallet or explorer.
• Unstake carefully. Unbonding usually takes 21 days on Cosmos Hub; plan for it rather than rushing into unofficial "instant unstake" services.

Why social-login wallets carry different risks

Social-login wallets remove the need to store a recovery phrase by splitting or deriving keys through a provider's infrastructure. That convenience creates a dependency: if the provider's key-management system fails, many wallets can be exposed at once, as happened here. Seed-phrase and hardware wallets put all of that responsibility on you, but they don't depend on a third-party service.

We have covered similar single-point-of-failure risks in wallet software, including the D'CENT app wallet security alert, the FomoPeek iOS wallet key exposure and phishing that followed the Trezor email provider breach. For a refresher on cleaning up permissions after any incident, read our guide on how to revoke token approvals after the Across domain hijack.

Frequently asked questions

Conclusion

Web3Auth's 14 November update restores access for existing users but leaves the most important question open: how and when rescued assets will be returned. If you used Google or Apple sign-in with Keplr, check your transaction history against Web3Auth's official recovery addresses, move any remaining funds to a seed-phrase or hardware wallet, and wait for the official return process rather than trusting anyone who offers faster recovery.

This article is for informational purposes only and is not financial or security advice. The Onchain Support is an independent publication and is not affiliated with Keplr, Web3Auth, Consensys or any exchange. We will never ask for your seed phrase, private keys, passwords or 2FA codes.