How the drain unfolded
Bitquery’s analysis identified roughly 44,700 distinct wallets touched by unauthorized transactions. Its breakdown counted 44,041 wallets on Cosmos ecosystem chains and 7,603 on Injective.
The Cosmos Hub took the biggest hit. Approximately $3.5 million of the losses came from that chain alone.
A chunk of that Cosmos Hub figure involved staked assets. About 1.96 million staked ATOM moved out without going through the usual 21-day unbonding period.
The timing data stings too. Bitquery traced 86% of drained funds on linked networks to transactions that happened after Keplr issued its initial warning on November 7, 2026.
Put plainly, most of the money left after users had been told something was wrong.
Where the blame is landing
Keplr, the wallet’s developer, attributed the breach to a security vulnerability in Web3Auth. That third-party service manages the social login flow and handles wallet keys for those accounts.
Web3Auth confirmed that a vulnerability in its infrastructure exposed the private keys of some third-party users. The company said it took protective measures, and those measures coincided with the attacker’s transaction patterns.
Keplr co-founder Josh Lee indicated the breach affected an estimated 20% of accounts created using social logins. He added that only a fraction of those had been fully exploited so far.
Keplr suspended Google and Apple logins immediately and started recovery efforts for affected accounts. As of November 8, 2026, neither Keplr nor Web3Auth had disclosed the exact technical cause of the breach.
Neither company had published a precise total for losses or the number of impacted accounts either. How much money can be recovered also remains undisclosed.
Why social logins and recovery phrases are different animals
A crypto wallet is ultimately controlled by a private key. Whoever holds that key can move the funds, full stop.
The classic way to back up that key is a recovery phrase, usually a string of 12 or 24 words. You write it down, stash it somewhere safe, and the responsibility sits entirely with you.
Social logins exist because recovery phrases are, frankly, a terrible user experience for newcomers. Services like Web3Auth let users sign in with familiar Google or Apple accounts instead.
The tradeoff is that key management leans on outside infrastructure. When that infrastructure has a flaw, the keys it helps manage can be exposed, which is what Web3Auth says happened to some users.
The reported damage in this incident clusters around accounts created through Google and Apple logins. Users who set up Keplr with a traditional recovery phrase were not the focus of the reported key exposure.
What this means for users and the Cosmos ecosystem
The immediate priority for affected users is simple. Anyone with a Keplr account created through Google or Apple should treat it as potentially exposed and follow Keplr’s recovery guidance.
The 86% post-warning figure is the detail worth sitting with. A large share of the losses happened after users were alerted, so how quickly wallet providers can reach their users during an active incident may matter as much as the fix itself.
The open questions are the ones to track. Keplr and Web3Auth still need to explain the exact technical cause, confirm the final loss total and number of affected accounts, and spell out how much users can expect to get back.
Until those answers arrive, the $6.01 million traced by Bitquery is a floor rather than a final tally.
cryptobriefing.com
