Some Keplr wallets set up with Google or Apple sign-in were drained by an attacker, while others were emptied by the provider to protect the money.
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen. Others may open their wallet and find it empty even though no thief took the funds. The login provider says it moved that money to safety first.
Keplr uses a company called Web3Auth to run its Google and Apple sign-in. An attacker used a security flaw at Web3Auth to reach the wallets, both companies said late last week. Keplr called it a "private key breach" for some users. A private key is the secret code that approves payments, so whoever holds it can move the money.
Web3Auth says it then used the attacker's own route to empty other at-risk wallets before the attacker got to them. With help from Keplr, it moved that money into recovery wallets for safekeeping.
Neither company has given a dollar figure for the theft. Keplr co-founder Josh Lee gave an early estimate: about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited. GoPlus, a Web3 security company, said at least about $1 million was stolen, without explaining how it got that number.
Blockchain data firm Bitquery counted at least $6.01 million moving from more than 44,000 wallets into the recovery wallets. It first reported those moves as theft, then corrected itself to treat them as a rescue. It says it cannot check who controls the recovery wallets.
Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected, Keplr said. Web3Auth also said its first look found no evidence that MetaMask users are affected. MetaMask's parent company, Consensys, bought Web3Auth in June 2025.
The steps are in the alert box above. The main point is to stay calm and rely on official updates. An empty balance is not proof of theft. Staked and locked assets are taking longer to secure, so those may not have moved yet. Web3Auth also warns that an unfamiliar address is not necessarily linked to the attacker.
If your Keplr wallet uses Google or Apple sign-in and looks empty, it may have been rescued, so wait for official word before moving anything.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersA breach at SEGA's email provider exposed 2.2 million newsletter addresses. The bigger risk is fake credit card emails, so it pays to know what to watch for.
Read more: SEGA says 2.2 million newsletter email addresses were exposedN-able switched off its hosted IT management service after a researcher posted attack code for more than 30 alleged flaws. Businesses that rely on IT providers should pay attention.
Read more: N-able shuts down IT management service after flaws posted online
