Keplr Wallet has received reports of unauthorized transactions affecting some accounts created through Google or Apple login and is investigating with Web3Auth. Cointelegraph reported the alert at 09:00 UTC on November 7, 2026. Keplr has suspended those login options and told potentially affected users to stop sending new funds to the accounts.
The response separates users by account creation method. Keplr's preliminary assessment says accounts created with recovery phrases or hardware wallets are unaffected. Social-login accounts may be exposed.
The cause remains under investigation; the initial notice does not confirm a fully diagnosed Web3Auth vulnerability.
Social-login accounts receive the deposit warning
Keplr's instructions, relayed by Lookonchain, address both funding and attempted recovery. Users should avoid adding funds to potentially affected accounts and should not re-import or recreate those accounts elsewhere during the investigation. Keplr also warned against private messages and links claiming to help recover assets.
Stopping deposits limits the additional funds entering an account under investigation. Avoiding re-imports prevents users from treating a change of wallet application as an approved remedy.
For someone preparing an exchange withdrawal, the practical implication is to pause if the destination is a Keplr account created through Google or Apple. A saved destination address deserves the same check as an address copied today. The relevant question is the account's origin.
The suspension also creates an access problem for people accustomed to signing in through those services. A failed login during the pause should not prompt a search for an unofficial replacement login page.
Users with several Keplr accounts should assess them separately. The preliminary notice distinguishes account types, so an account created through social login and another connected through a hardware wallet should not automatically receive the same classification.
Web3Auth confirms a security incident
Web3Auth's own status page says its Login Service has been placed into maintenance because of a security incident. The provider says it is taking precautionary measures and will update users when service is restored.
That notice confirms an operational response at the authentication provider. Users should therefore treat the disruption as a security event rather than an ordinary login outage.
Restoring service and completing the security investigation are separate outcomes. Restoration would mean the provider has resumed the affected service. Users would still need Keplr's instructions about existing accounts before treating restoration as permission to resume deposits or repeat the account setup process.
For now, Keplr's account-specific guidance offers the clearest instructions for users. A general service-status change should be read alongside that guidance, especially when the wallet provider has explicitly asked users to suspend particular actions.
The joint investigation spans the Keplr accounts involved in the reported transactions and their Web3Auth login dependency. An explanation of the incident needs to account for both parts of that relationship.
Account creation changes the security dependencies
Keplr's official security documentation explains that Google-login accounts use Web3Auth to generate a private key through distributed key generation technology. The resulting key is encrypted and stored locally on the user's device. Those accounts receive a hexadecimal private key instead of a 12- or 24-word recovery phrase.
The same documentation describes a different signing process for Ledger accounts. The private key stays within the hardware device. Keplr sends an unsigned transaction to it and receives the transaction after the user verifies and signs it.
These are different ways of creating and using an account inside the same wallet application. They help explain why Keplr distinguishes social-login accounts from recovery-phrase and hardware-wallet accounts in its initial assessment.
For users evaluating wallet custody, the incident puts a specific dependency in focus: the service involved in creating or accessing the signing key. A familiar login button can make account setup easier while introducing another provider into that process.
Moving an existing key into another application does not create a new key. That is why an application switch should not be assumed to resolve a problem affecting the account itself, particularly while Keplr is advising against re-importing.
Keplr's standing security guidance also says it will never contact users asking for their recovery phrase. It warns that importing the same phrase into multiple wallets increases exposure risk. Those cautions are relevant when unsolicited recovery messages arrive during an incident.
Overview
Keplr has paused Google and Apple login after unauthorized transaction reports involving some accounts created through those methods. It is investigating with Web3Auth, whose Login Service is in maintenance because of a security incident.
Social-login accounts require precautionary handling, while Keplr's preliminary assessment excludes recovery-phrase and hardware-wallet accounts. Its current instructions are to stop new deposits into potentially affected accounts and avoid re-importing or recreating them elsewhere.
