Keplr Suspends Google and Apple Sign-Ins After Reports of Unauthorized Transactions

Key Facts

Keplr temporarily suspended Google and Apple sign-ins after receiving reports of unauthorized transactions in some accounts created using those methods, according to a statement cited by The Crypto Times on November 7, 2026. The company said it had referred the matter to Web3Auth for a joint investigation. It said accounts created through Google or Apple may be affected, without disclosing how many accounts were covered by the reports. It asked users who may be affected not to send new funds or re-import their accounts. It also warned against unofficial messages and links offering help with account recovery.

Keplr’s preliminary assessment, as reported by the company, distinguished between accounts based on how they were created or connected to wallets. It said accounts created with a recovery phrase, as well as accounts connected to a hardware wallet, were not affected according to the preliminary assessment. Accounts created using Google or Apple, by contrast, may be affected. This means the announced warning is focused on the social sign-in route, while the joint investigation will determine the scope of the incident. The reported statement did not include a final count of affected accounts or information on assets that had been transferred.

Web3Auth’s official status page said its Login Service had entered maintenance mode because of a security incident. The company set the maintenance window from November 6 at 18:30 to November 7 at 18:30 UTC, or one day. Web3Auth said it had temporarily suspended its embedded wallet service because of a security issue in services used by some third parties. It added that its preliminary investigation had found no evidence that MetaMask users were affected. This indicates that Keplr’s suspension coincided with action affecting the infrastructure provider’s login service, while an investigation into the impact on the accounts concerned remains underway.

Keplr’s support documentation explains that Google accounts use Web3Auth to generate a private key using DKG technology, after which the key is encrypted and stored locally on the user’s device. It also says this type of account receives a private key instead of a recovery phrase. In its description of the wallet, The Crypto Times reported that Keplr is non-custodial, meaning users control the private keys that authorize transactions. This setup makes sign-in part of the process for creating wallet access, but on its own does not establish how the transactions reported by users occurred. The company had not announced a root cause for the incident by the time of the report.

The scope of the incident was still unclear when the report was published: Keplr and Web3Auth had not announced the total number of affected accounts, the value of the assets involved, or the chains and tokens covered by the transactions. The companies had also not disclosed the root cause or a timeline for resolution. The announced maintenance window for Web3Auth’s service was due to end on November 7 at 18:30 UTC, and the company said it would provide an update when service was restored. Keplr’s immediate guidance centers on avoiding funding potentially affected accounts and not re-importing them, and on verifying any recovery-related communication through official channels. The scale of losses and the scope of the accounts involved remain subject to what the companies announce after completing their investigation.

The incident’s significance extends beyond users of a single wallet because sign-in services and embedded wallets are widely used in digital-asset applications. Consensys announced in June 2025 that it had acquired Web3Auth, saying at the time that its infrastructure supported nearly 50 million end users and powered more than 8,200 decentralized applications. The company said the acquisition was intended to integrate embedded-wallet infrastructure into the MetaMask experience, allowing users to create and recover wallets through familiar login methods. MetaMask’s developer documentation calls this infrastructure Embedded Wallets, the current name for what was previously known as Web3Auth. This background shows the infrastructure’s broad use, while the scope of the impact in the Keplr incident remains undisclosed.