If you created a Keplr wallet with Google or Apple, the question is whether that login path left the account exposed. A mnemonic phrase or a hardware wallet is a different setup, and the report below treats those paths separately.
On November 9, 2026, TechFlow reported—citing GoPlus monitoring—that a vulnerability at Web3Auth, the social-login provider, left some Keplr users with exposed private keys or compromised signing ability. GoPlus estimated that at least about $1 million in assets were stolen. About $6 million more was moved to an officially confirmed rescue address. Both figures are GoPlus monitoring estimates, not a final audited loss total, and the rescue transfer is not the same claim as the theft.
GoPlus said the affected wallets were Keplr accounts created by signing in with Google or Apple. Accounts created with a mnemonic phrase or a hardware wallet were not affected.
TechFlow had earlier reported that Web3Auth published recovery addresses and said some transfers made to protect assets were mistaken for attacker activity. Do not assume every movement of funds in this episode was a theft.
Social login can make a wallet easier to reopen, but it places transaction signing with an outside service. A mnemonic phrase or a hardware wallet keeps signing with the holder, in exchange for protecting that phrase or device. Easier access, secrecy of the key material, and having more than one recovery copy are different goals; this incident does not show that any one setup removes every risk. The report only says mnemonic and hardware accounts were outside the affected group.
Checks that follow from the report:
- A Keplr wallet created with Google or Apple is in the group GoPlus flagged.
- A Keplr account created with a mnemonic phrase or a hardware wallet was, according to GoPlus, not affected.
- Funds sent to a published recovery or rescue address are not the same as the assets GoPlus described as stolen.
- Do not share a seed phrase, private key, or login with anyone offering help. This note does not ask for those secrets.
Original report by TechFlow, published November 9, 2026, at 13:27 (UTC+8): TechFlow
