Keplr has paused Google and Apple login after reports of unauthorised transactions on some accounts created through those sign-in methods. In its 7 November notice, the wallet team says affected social-login accounts may be at risk and asks users to stop sending new funds or re-importing or recreating those accounts while the investigation continues.
The Keplr login warning follows Web3Auth’s announcement that it temporarily paused its embedded-wallet service because of a security issue affecting services used by some third parties. Keplr says it flagged the transaction reports to Web3Auth and is working with its team. Neither notice supplies a confirmed loss total or a technical explanation of the incident.
Keplr login method determines the initial warning
Keplr distinguishes accounts created with Google or Apple from wallets created using a recovery phrase or hardware wallet. Its initial assessment says the latter are not affected. For social-login accounts, its wording is conditional: the account “may be affected”, rather than a statement that every such wallet has lost funds.
The notice’s instructions are specific:
“Do not send new funds to that account.”
“Do not re-import or recreate it anywhere.”
Keplr also says to trust updates only from its official account and ignore direct messages or links offering recovery. Its pause is not an instruction to migrate the account, share credentials with support accounts or follow an unsolicited recovery procedure. The distinction matters because the team has promised verified details and next steps rather than publishing a general recovery method.
The official Keplr post was published at 04:38 GMT on 7 November. Web3Auth’s initial notice appeared at 21:13 GMT on 6 November, followed immediately by a promise to share confirmed details and any required steps. Those timings establish the public sequence of the notices, not when the underlying security issue began.
Web3Auth’s MetaMask statement remains preliminary
Web3Auth says that, after an initial investigation, it had found no evidence that MetaMask users were impacted. That is a statement about evidence available at that stage. It is narrower than a final assurance that every service using the technology is unaffected, and narrower than a conclusion that no further users could be identified.
The two teams also describe different scopes. Keplr names a particular account-creation route and transaction reports. Web3Auth names an embedded-wallet service pause affecting services used by some third parties. Their statements establish a joint investigation and overlapping service concerns, but leave the mechanism, full affected population and remediation timetable unresolved.
A service pause is not a diagnosis of every wallet
The immediate reading task is to keep account type, provider scope and investigation status separate. A Keplr wallet created through Google or Apple falls inside the conditional warning; a phrase-created or hardware-wallet account sits outside it according to Keplr’s initial assessment. Web3Auth’s provider-wide pause is broader operational action, but its notice does not identify every affected application. Combining those statements into a claim that all Keplr wallets, all embedded wallets or all MetaMask users are compromised would discard the boundaries the teams actually supplied.
The same caution applies in the opposite direction. An initial “no evidence” finding is useful information, not a completed forensic report. It cannot settle a mechanism that neither provider has disclosed. For users trying to decide which instructions apply, the most important fact is therefore how the account was created, followed by the official notice for that service. Keplr’s explicit instruction against re-importing or recreating the account rules out treating generic migration advice as the announced remedy. Further action depends on the verified next steps the teams have promised.
Earlier wallet incidents underline why mechanisms should remain distinct. Qubic’s weak-seed wallet drain and network halt involved a different disclosed cause. the GitBook API-token attack concerned another credential and service boundary, while the Binance security incident is an exchange story rather than evidence about Keplr’s login system. These cases provide security context, not a basis for importing their causes or losses into this investigation.
The next substantive update is the teams’ confirmed scope and user guidance. Until it appears, Keplr’s official account remains the source for its paused Google/Apple route, and Web3Auth’s embedded-wallet pause remains a separate provider notice.
Sources
Related stories
Qubic Halts Its Network After Wallet Drain offers a contrasting wallet incident with a disclosed weak-seed mechanism; it is not a recovery guide for Keplr.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
