A Flaw at Login Provider Web3Auth Drains More Than 44,000 Keplr Wallets

MakeCryippreferred on

• An attacker drained more than 44,000 Keplr wallets created through Google or Apple social login across seven Cosmos chains, plus roughly 7,600 more on Injective
• About $6.01 million in stolen funds sat untouched in two attacker-controlled collector addresses at the time the investigation was last verified
• Roughly 1.96 million staked ATOM was pulled out early by converting stakes into tokenized shares, a method that bypasses the usual 21-day unbonding period

A blockchain forensics investigation verified on November 7, 2026 traced a wallet-draining incident back to a flaw in Web3Auth, the Consensys-owned infrastructure provider that powers Keplr’s option to create a wallet using a Google or Apple account instead of a traditional seed phrase. Rather than a bug in Keplr’s own code or in any single blockchain’s smart contracts, the root cause sits in the shared login infrastructure that multiple wallets and chains rely on, meaning the exposure reached far beyond any one application.

The investigation documents an attacker draining more than 44,000 wallets across seven Cosmos-ecosystem chains, with an additional roughly 7,600 wallets affected on Injective, bringing the total close to 44,700. Collector addresses tied to the attacker held approximately $6.01 million at the time the figures were last verified, spread across chains including the Cosmos Hub, Osmosis, Injective, Akash, Celestia, Noble and dYdX, with the Cosmos Hub accounting for the largest single share at roughly $3.5 million.

A particularly notable mechanism in the attack involved staked ATOM. Rather than waiting through Cosmos’s standard 21-day unbonding period to withdraw staked funds, the attacker used the Liquid Staking Module’s share-tokenization feature to convert roughly 1.96 million staked ATOM into transferable share tokens, effectively bypassing the delay built into normal unstaking and allowing funds to be moved out far faster than a legitimate withdrawal would permit.

Individual losses skewed heavily toward small amounts: the median loss across affected wallets was just $1.34, and roughly 88% of victims lost less than $100, even as the largest single reported loss reached $325,000. That distribution reflects how many of the affected wallets were created casually through social login for small or experimental balances, a usage pattern that embedded-wallet providers are specifically designed to make frictionless, but which also means a shared infrastructure flaw can touch an unusually large number of accounts at once even when the typical dollar amount per account stays small.

The incident adds embedded, social-login wallet infrastructure to a growing list of attack surfaces crypto users now need to weigh, alongside more familiar risks like seed-phrase theft, smart-contract bugs and exchange hot-wallet breaches. The full forensic breakdown is published on Bitquery’s own investigations page.