Overview
- Keplr began receiving reports of unauthorized transfers on wallets created with Google or Apple logins during November 6–7 and disabled those sign‑in options while it investigated with Web3Auth.
- Blockchain firm Bitquery tracked about $6.01 million moving from roughly 44,000 Cosmos addresses and 7,600 Injective addresses but cautioned that on‑chain movement shows transfers not intent.
- Web3Auth says many of the flagged transfers were whitehat recoveries routed to published, verified recovery addresses and it has paused its embedded‑wallet service while investigating.
- Keplr estimates roughly 20% of social‑login accounts could have been exposed though only a fraction appear fully exploited and the wallet says accounts made with a recovery phrase or hardware device were not affected.
- The incident highlights concentration and supply‑chain risk from outsourcing key management to embedded social‑login providers and leaves open urgent questions about a full technical postmortem, final losses, and a user reconciliation process.