Keplr Wallet warns some users who log in via Google or Apple to transfer their remaining assets; users with mnemonic phrases or hardware wallets are unaffected.

On November 8, Keplr Wallet announced a security vulnerability in the Web3Auth infrastructure, which led to the exposure of private keys for some Keplr users who created wallets using Google or Apple login. Users who set up accounts via mnemonic phrases or hardware wallets remain unaffected. Keplr is currently collaborating with Web3Auth on asset protection efforts, and remediation remains ongoing. Due to the more complex on-chain mechanisms involved in staking and locked assets, their resolution will take significantly longer. As a result of risk-mitigation measures, some Google- or Apple-login accounts are already showing reduced—or even zero—balances in the UI. Keplr urges all users who registered via Google or Apple login to treat their accounts as potentially compromised: immediately halt new deposits into such accounts, and promptly transfer any remaining accessible liquid assets to secure accounts generated via mnemonic phrases or hardware wallets. Keplr and Web3Auth are jointly developing a self-check tool to help users determine whether their accounts were impacted. Keplr emphasizes that users should rely solely on official announcements from Keplr’s and Web3Auth’s verified social media accounts—and must ignore unsolicited direct messages or external links claiming to “recover assets.”