Keplr Pauses Google and Apple Login After Unauthorized Transfers

Keplr paused Google and Apple login early Saturday after it received reports of unauthorized transfers from some accounts created that way, the Cosmos wallet said in a post on X timed at 04:38 UTC.

Recovery-phrase and hardware-wallet accounts are not affected in Keplr's initial assessment. Social-login users were told not to send new funds to those accounts and not to re-import or recreate them while the probe runs. Google and Apple login stay paused.

What social login does

Social login lets a user open a wallet with a Google or Apple account instead of writing down a recovery phrase. Keplr routes that flow through Web3Auth, a Consensys-owned login provider that rebuilds a private key when a valid login token is checked. Seed-phrase wallets never pass through that service, which matches Keplr's first split: phrase and hardware accounts clear, Google and Apple accounts may not be.

Web3Auth and MetaMask's read

Web3Auth's status page says it placed the Login Service into maintenance at 05:53 UTC Saturday "due to a security incident," with a precautionary pause until the service is restored. In a MetaMask Builder forum note, Web3Auth said the issue affects its Embedded Wallet services used by some third parties and that an initial check found no evidence MetaMask users were hit.

Neither Keplr nor Web3Auth has published a count of accounts, a dollar loss, a chain list or a cause. Keplr said updates will come only from its official account. It told readers to ignore direct messages and links that offer "recovery."

In our opinion: the open question is still size. Until Keplr or Web3Auth posts a loss figure and a cause, the practical check for readers is whether any funds sit in a Google- or Apple-created Keplr account and whether those balances stay put overnight.