Keplr says some users spotted transactions they did not authorize. It has asked anyone who created a wallet with Google or Apple to stop sending funds to that account.
Keplr suspended Google and Apple sign-ins on November 7 after some users reported transactions they had not authorized. The reports came from wallets created with those sign-in methods. Keplr said it alerted Web3Auth, which provides the feature, and the two teams are investigating together.
Which Keplr accounts may be affected?
Exposure depends on how the owner set up the wallet. Using Keplr on an iPhone, for example, does not necessarily mean the owner signed up with Apple. Keplr said its initial assessment ruled out accounts created with a recovery phrase and those connected through a hardware wallet.
Keplr asked Google and Apple sign-in users to stop sending assets to those accounts. It also told them not to import their accounts into another wallet or recreate them anywhere. The team directed users to its official X account for updates and warned them to ignore private messages or suspicious links offering to recover funds.
Keplr’s notice about unauthorized transactions and accounts created with Google or Apple
The post loads from X when you open it.
Keplr’s mobile setup guide explains that a user who opens a wallet with Google normally receives a private key instead of a set of recovery words. The key authorizes transactions from the wallet. According to the guide, if the user loses both the key and access to their Google account, Keplr cannot restore the wallet. For accounts created with a phrase, the team does not keep a copy of the words.
What does the 20% estimate cover?
Keplr co-founder Josh Lee estimated that the incident may have affected about 20% of accounts created with Google or Apple. He believes attackers have made unauthorized transactions from only a fraction of that group and that the remaining accounts may be recoverable. He did not say how many wallets lost funds or how much was taken.
Lee attributed the incident to Web3Auth and said attackers had not compromised Keplr’s code. Keplr is working with the Web3Auth and MetaMask teams to track the affected accounts and recover funds. The Crypto Times said it could not independently verify users’ claims of additional losses.
What did Web3Auth say about the service pause?
Web3Auth said it had identified a security issue in services used by some third parties and temporarily paused its embedded wallet service. Developers use that service to offer wallets inside their own applications. The provider said its initial investigation found no evidence that MetaMask users were affected.
Consensys, the company behind MetaMask, announced its acquisition of Web3Auth on June 2, 2025. One aim was to let developers add social sign-in and key management to their apps.
Web3Auth’s maintenance notice for the login service lists a 24-hour window from 18:30 UTC on November 6 to 18:30 UTC on November 7. The provider said it would post an update when service resumed. Keplr did not give a firm time for restoring sign-in or a timetable for returning funds.
