The Keplr wallet breach affects some people who signed in with Google or Apple. A flaw in Web3Auth, the login service used by Keplr, exposed private keys. Web3Auth says it moved funds from affected wallets to new recovery addresses. The work is still in progress. The $5.6 million reported in those addresses does not mean every user has been repaid.
What the Keplr wallet breach exposed
The issue began in Web3Auth’s login system, not in Keplr’s core wallet code, according to The Block. It affected some Keplr accounts made with Google or Apple sign-in. Keplr said wallets made with a recovery phrase or a hardware wallet were not affected by this incident.
Keplr’s co-founder said about 20% of social-login accounts could be affected. That is an estimate of the group at risk. It does not mean every account in that group lost funds. Web3Auth paused the service while it checked the issue.
How Web3Auth responded to the Keplr wallet breach
Web3Auth began a recovery effort. It moved funds from vulnerable wallets that had not yet been reached by the attacker. The Block reported that 12 recovery addresses held about $5.6 million in crypto on November 8. The figure came from on-chain data. Web3Auth said the funds were safe and that it was working with Keplr on a return plan.
The companies have not shared the final number of wallets reached by the attacker. They have also not confirmed the total amount lost. Some recovery transfers were first mistaken for attacker activity. The Keplr wallet breach is still an active response, not a completed recovery.
Who is at risk after the Keplr wallet breach
The reported risk is limited to some accounts made with Google or Apple login through Web3Auth. Keplr said recovery-phrase and hardware-wallet accounts were not affected. Users should wait for an official way to check their account. A balance that has not changed is not proof that an account is safe.
For more wallet-security context, read our report on the Keystone wallet data breach. The cases involve different systems. Both show why users should know how a wallet service protects account access and signing keys.
What users should do after the Keplr wallet breach
Keplr told Google and Apple login users not to add new funds to affected accounts. It also advised users to move any remaining liquid assets to a wallet protected by a recovery phrase or hardware device. Follow updates from Keplr and Web3Auth only. Ignore direct messages that promise to recover funds.
Never share a recovery phrase with support staff or anyone offering help. A recovery address holding funds does not prove that all losses have been paid back. Users should wait for a trusted exposure checker and clear steps for account recovery.
Sources: The Block, November 8, 2026; Web3Auth service status, November 6, 2026; Keplr Wallet.
