Bitquery Estimates Funds Linked to Keplr Wallet Breach at About $6.01 Million
Key Facts
Unauthorized transfers targeted Keplr wallets opened through social login using Google or Apple on Nov. 6 and 7, 2026, and Keplr disabled both login options after reports of the transactions. Bitquery estimated that about $6.01 million had reached two collection addresses, based on prices on Nov. 7. The estimate includes funds held at the two addresses, while withdrawals from Cosmos Hub were still underway at the time of measurement. Bitquery said its estimate was based on the chain transfers it reviewed. It described what happened by saying an attacker “drained Keplr wallets opened through social login” over the two days.
Bitquery counted at least 44,041 wallets that sent funds to the collection addresses across seven chains in the Cosmos ecosystem, as well as 7,603 wallets on Injective that sent funds to the collection address. The Cosmos figures cover seven chains, while Bitquery said its estimate of Injective wallets was based on a sample. The tally indicates that the incident affected users across more than one network, rather than a group of accounts on a single chain. The figures cover transfers tracked by Bitquery through Nov. 7, 2026. The number of wallets is not the same as the number of users, as the figures do not identify their owners or indicate whether one person may have had more than one wallet.
The sequence of the warning and transfers features in Bitquery’s estimate of the damage: Keplr issued its warning at 04:38 UTC on Nov. 7. The company said 86% of the wallets across the seven chains it tracked lost funds after the warning was issued. The percentage represents the share of affected wallets after that time, according to Bitquery’s measurement on Nov. 7. The figures place the warning in the timeline as transfers continued, but do not by themselves establish when each user received the alert or whether they saw it. The estimated value of the funds remained tied to the time of measurement, while withdrawals from Cosmos Hub were still underway.
Keplr’s guidance published before the incident describes the Google login process: the wallet uses Web3Auth to generate a private key using DKG technology, then encrypts the key and stores it locally on the user’s device. Keplr also says the account creates a hex-format private key instead of a 12- or 24-word recovery phrase. This distinguishes how these accounts are created from wallets that rely on a recovery phrase, explaining the difference in the account recovery process. Keplr’s guidance did not identify the cause or mechanism of the incident, and Web3Auth’s notice did not provide details. The published description of the login setup therefore serves as technical background, not an explanation for why the wallets were targeted.
In a status notice, Web3Auth said it had placed its login service in maintenance mode as a precaution following a security incident, and that it would post an update when service was restored. The company set the maintenance window from Nov. 6 at 18:30 to Nov. 7 at 18:30 UTC, a period of one day. The notice did not detail the nature or cause of the incident. The service suspension thus coincided with the transfer period Bitquery tracked on Nov. 6 and 7, without the status notice providing a technical explanation of the link between them. The estimated $6.01 million in funds remained based on prices on Nov. 7, with withdrawals from Cosmos Hub still underway at the time of measurement.