Keplr Social-Login Wallets Drained for $6.01M, Bitquery Says

Keplr's social-login users got hit hard. At least $6.01 million drained from the wallet over November 6-7, 2026, and blockchain analytics firm Bitquery traced it straight back to private keys tied to Google and Apple sign-ins.

The numbers are ugly. Bitquery counted roughly 44,700 wallets touched by unauthorized transactions, with 44,041 on Cosmos ecosystem chains and 7,603 on Injective. Cosmos Hub ate about $3.5 million of the damage on its own, including roughly 1.96 million staked ATOM that walked out without the usual 21-day unbonding wait.

Keplr pointed the finger at Web3Auth, the third-party service that runs the social login flow and handles keys for those accounts. Web3Auth confirmed a vulnerability in its infrastructure exposed private keys for some third-party users, said it took protective measures, and noted those measures lined up with the attacker's transaction patterns. Keplr co-founder Josh Lee estimated 20% of social-login accounts were affected, with only a slice fully exploited so far.

Keplr shut off Google and Apple logins right away and kicked off recovery efforts. Users who set up wallets the old way, with a 12- or 24-word recovery phrase, weren't the focus of the reported exposure, since those keys never leaned on outside infrastructure.

Here's the detail that stings: Bitquery found 86% of drained funds on linked networks moved after Keplr's first warning on November 7. Most of the money left after users had already been told something was wrong.

As of November 8, neither Keplr nor Web3Auth had explained the exact technical cause, confirmed a final loss total, or said how much users might get back. Until those answers land, Bitquery's $6.01 million looks like a floor, not a final tally.