Bitquery traces $6.01M theft to Keplr wallets created with Google and Apple logins

Blockchain analytics firm Bitquery traced the stolen funds to approximately 44,700 distinct wallets, with 44,041 on Cosmos ecosystem chains and 7,603 on Injective. The Cosmos Hub suffered the most significant losses, accounting for about $3.5 million of the total stolen amount.

Among the stolen assets were approximately 1.96 million staked ATOM that were moved without going through the standard 21-day unbonding period. Notably, 86% of the drained funds on linked networks were transferred after Keplr issued its initial warning on November 7, 2026.

Security vulnerability identified

Keplr attributed the breach to a security vulnerability in Web3Auth, the third-party service managing social login flows and wallet keys for accounts created with Google or Apple logins. Web3Auth confirmed the vulnerability exposed private keys of some users and stated it implemented protective measures that aligned with the attacker's transaction patterns.

Social login risks explained

Unlike traditional wallets secured by recovery phrases, social login wallets rely on external infrastructure for key management. The trade-off for convenience comes with increased vulnerability when that infrastructure has flaws. In this case, users who set up Keplr with traditional recovery phrases were not affected by the reported key exposure.

Following the breach, Keplr immediately suspended Google and Apple logins and began recovery efforts for affected accounts. As of November 8, 2026, neither company had disclosed the exact technical cause, precise loss totals, or the number of impacted accounts.

User implications and next steps

Affected users with Keplr accounts created through Google or Apple should treat them as potentially exposed and follow Keplr's recovery guidance. The significant post-warning losses highlight the critical importance of rapid user communication during active incidents.

Open questions remain about the exact technical cause, final loss totals, and recovery prospects. Until these answers emerge, the $6.01 million traced by Bitquery represents a minimum estimate of the losses.