Bitquery Traces $6.01M Theft from Keplr Wallets Linked to Social Logins

A significant theft of at least $6.01 million from Keplr wallets occurred between November 6 and 7, 2026, as reported by blockchain analytics firm Bitquery. The analysis indicates that the losses stemmed from exposed private keys associated with accounts created through social logins, specifically Google and Apple.

Bitquery's investigation identified approximately 44,700 distinct wallets involved in unauthorized transactions, with the majority affected being on Cosmos ecosystem chains. Notably, around $3.5 million of the losses were traced back to the Cosmos Hub, including a substantial amount of staked assets that were moved without the typical 21-day unbonding period.

Despite an initial warning issued by Keplr on November 7, 2026, about 86% of the drained funds were transferred after users had been alerted, raising concerns about the wallet provider's ability to communicate effectively during security incidents.

Keplr's co-founder, Josh Lee, attributed the breach to a vulnerability in Web3Auth, the third-party service managing social login functionalities. Web3Auth confirmed the existence of a security flaw that exposed private keys for some users, stating that they have since implemented protective measures.

Keplr has suspended social logins and initiated recovery efforts for affected accounts. However, neither Keplr nor Web3Auth has disclosed the specific technical cause of the breach or the total number of impacted accounts. The situation remains fluid, with users urged to treat their accounts created via social logins as potentially compromised.

In a subsequent response, Web3Auth disputed the $6.01 million figure, claiming that many of the funds moved to verified recovery wallets rather than being stolen. This dispute highlights the complexities of tracking on-chain transactions, where recovery operations can appear similar to theft.

As the situation develops, users are advised to rely on official channels for updates and to refrain from depositing new funds into affected accounts.

New Facts on Keplr Wallet Hack

• The hack primarily affected users who created their wallets using Google or Apple logins.
• Web3Auth identified several flagged addresses as their own recovery wallets, indicating a complex situation for affected users.
• Bitquery reported that approximately 44,700 Keplr wallets were impacted across eight Cosmos-based chains.
• The largest single loss from the hack was around $325,000.
• Web3Auth initiated a whitehat operation to secure funds from vulnerable wallets before they could be accessed by the attacker.
• Web3Auth has not disclosed the total amount of funds it secured during the operation.
• Recovered funds are confirmed to be safe, and Web3Auth is collaborating with Keplr to facilitate their return.
• In 2026, North Korean hackers were reported to have stolen $7.61 billion in total from various crypto-related incidents.
• Other projects, such as PancakeSwap, reassured users that their funds and smart contracts remain secure amidst the hack.