Keplr shuts off Google and Apple sign-in after a flaw at Consensys-owned Web3Auth exposed wallet keys, and about $6 million moved out of Cosmos accounts

Keplr, a wallet built for Cosmos-based networks, has switched off its Google and Apple login option after attackers took funds from some accounts created that way. The company says its own wallet code was not compromised. It points instead to Web3Auth, the outside service that creates a private key for users who sign in with a Google or Apple account rather than writing down a recovery phrase. Web3Auth, which is owned by MetaMask developer Consensys, acknowledged a problem in its infrastructure that exposed private keys and paused its embedded wallet service.

Bitquery counted about $6 million sent to two collection addresses, with Cosmos Hub accounting for about $3.5 million, crypto.news reports. Josh Lee, co-founder of Keplr developer Chainapsis, estimated that about 20% of social-login accounts could be affected, with only some actually drained.

The cleanup is messy. Web3Auth says it and its partners began moving funds out of exposed wallets that had not yet been hit, using the same route as the attacker, and Keplr warned on Saturday that some users may find their balances reduced or empty because of the rescue. Web3Auth says it found no sign that MetaMask users were affected.

Keplr is telling social-login users not to deposit more funds and to move what is left to a recovery-phrase or hardware-wallet account. Web3Auth plans to publish a verified list of the addresses holding rescued funds.