An attacker took at least $6.0M from 44,000+ Keplr wallets that used Google or Apple login, on eight Cosmos chains. None of it has moved yet.
The theft ran for 18 hours across eight chains. We read every transfer it made to count the losses, to see how staked coins got out so fast, and to find what can still be stopped.
- $6.01M
- 86%
- 1.96M
- 19 s
- 81,006
- 2
01 · What happenedKeplr wallets that used Google login were emptied
Late on 6 November, users of Keplr, a crypto wallet app, found their wallets empty. They had signed up the easy way, with a Google or Apple account. Their coins had gone to a stranger's address.
One of them posted the ID of the transfer that emptied their wallet. It went out late on Friday night and moved nine kinds of tokens to that address in one step.
Keplr confirmed the thefts at 04:38 UTC the next morning. In a post on X, it said accounts created with Google or Apple login had seen transactions their owners did not make. Wallets backed up with a recovery phrase, the usual list of 12 or 24 words, were not affected, it said, and neither were hardware wallets. Keplr paused the Google and Apple login. Seven hours earlier, Web3Auth, the company behind that login, had reported a security issue. It had paused its embedded wallet service.
We followed the money from that first transfer. Each theft was a sweep, one transfer that empties a wallet into the thief's address. The same thief swept wallets on eight chains in Cosmos, a family of linked blockchains. At least 44,041 wallets lost funds, and the two collecting addresses now hold about $6.01M. The thief has not moved any of it. Most wallets were emptied after Keplr's warning, and the Cosmos Hub drain was still going when we finished counting.
02 · The loginWhat Keplr social login is, and where Web3Auth fits
Keplr is a wallet app for Cosmos, a family of linked blockchains that includes Cosmos Hub, Osmosis and Celestia. Like any crypto wallet, it rests on a private key, a secret number that signs every payment. Whoever holds the key holds the money.
Most Keplr users keep that key as a recovery phrase, 12 or 24 words written down somewhere safe. Keplr also offers a shortcut, called social login: sign in with Google or Apple and never see the words. Web3Auth runs that sign-in. It is a login service for crypto apps. In 2025 it joined Consensys, the company behind MetaMask. The service rebuilds the wallet's key each time the user signs in, so the user never has to keep it.
On Cosmos chains, one key opens an address on every chain at once. Only the start of the address changes, such as cosmos1 on Cosmos Hub and osmo1 on Osmosis. So a stolen key empties every chain the owner used, in one sitting.
Neither Keplr nor Web3Auth has said how the keys were exposed, and the ledger cannot show it. The ledger shows what came next. The thief held the keys, as in the LootBot drain and the iPhone wallet drains on TRON. Nobody was tricked into signing anything, which sets it apart from a wallet drainer on a fake site.
03 · The moneyOne Keplr attacker address, seven chains
The thief's receiving address is called a collector. A Cosmos address looks almost the same on every chain, since only the start and the last six characters change. That gave the thief's other collectors away. The one that took that first victim's tokens, on Osmosis, has twins on Cosmos Hub, Celestia, Akash, Noble, dYdX and Babylon, and all seven got stolen funds. A second collector did the same job on Injective.
Cosmos Hub holds the most, $3.50M, nearly all of it in ATOM, the chain's own coin. Osmosis comes next, with more than a thousand kinds of tokens, from USDC and bitcoin to pool shares.
Neither address has sent a single transaction on any chain. On the seven chains where the sweeps have stopped, we added up every transfer in and compared it with the balance. They match to the last unit, so nothing has left.
04 · The victimsMost Keplr victims lost a little, a few lost a lot
Most victims lost little. The typical wallet lost $1.34, and 88% lost under $100, so the money sits with a few dozen large wallets that carry a third of the total between them. The biggest single loss was $325K.
Because one key opened every chain, many people were hit more than once. 46% of the drained wallets lost funds on two or more chains.
05 · The timingThe Keplr drain kept going after the warning
The first sweep came at 20:52 UTC on Friday. Within seconds, 10 Cosmos Hub wallets each sent the thief the same tiny amount, worth under 2 cents. It looks like a test. Web3Auth posted its notice soon after.
The first wave hit Cosmos Hub, Osmosis, Celestia and Akash before midnight. The night was quieter. Keplr warned its users at 04:38 UTC, and two hours later the biggest wave began, six times the size of the first.
Counted by wallet, 86% of the victims on the seven same-key chains lost their funds after Keplr's warning. Pausing the login did not protect them, because the thief already held their keys.
Then, just after 10:34 UTC, the sweeps stopped on seven chains within the same 19 seconds. Only Cosmos Hub went on. There, the thief was still taking staked ATOM, and the drain kept going into the afternoon.
06 · The stakeHow staked ATOM left without the 21-day wait
Many Cosmos users stake their ATOM. They lock it with a validator, one of the computers that run the chain, and earn rewards in return. Getting staked ATOM back normally takes 21 days, a wait called unbonding. That wait should have slowed the thief down.
Cosmos Hub has a feature that skips it, built for liquid staking, where a token stands in for a stake so the stake can be traded. A staker can turn a stake into a share token, which stands for the staked ATOM and moves like any other coin. The thief used it on every victim with a stake.
From 09:57 UTC on Saturday the thief packed victims into bundles of up to six wallets each. A separate gas wallet paid the fee. Each bundle did three things to every victim in it.
First it pointed the victim's staking rewards at the thief. Then it turned the stake into a share token, and then it sent the token to the collector. Bundles had done this to 13,030 wallets by the time we stopped counting.
The first step paid off at once. Turning a stake into a token pays out the rewards it has earned, and those now went to the thief as well, worth about $251K.
The share tokens are not cash yet. To turn them back into ATOM, the thief must wait out the same 21 days or hand them to a liquid staking service that takes such tokens. So far the thief has done neither.
07 · InjectiveA second collector on Injective
Injective is another Cosmos chain, but its addresses look like Ethereum's. So the same key gives an address there that looks nothing like the others. We found it by checking the largest victims one by one. Of the 39 we checked, 11 had sent funds on Injective, and all 11 had sent them to one address, which starts inj1lqmdmu.
That address emptied 7,603 wallets on Saturday morning and now holds $615K, mostly in USDT and INJ, Injective's own coin.
The victims match. Nine in ten of its victims, in a sample we checked, had also been drained on the other seven chains. The clocks match too. Its biggest burst came in the same morning hour, and its last sweep landed in the same second as the last ones on Akash, Noble and dYdX. Injective adds about 690 new wallets, which brings the total to about 44,700.
An Injective address is also an Ethereum address in disguise. We checked this one, 0xf836dd…ac29, with Bitquery data on Ethereum, Base, BNB Chain and Arbitrum. It has no activity on any of them.
08 · The leadThe gas wallet, and the two wallets that paid for it
A bundle needs someone to pay the network fee, so the thief used a separate gas wallet that signs every bundle next to the victims. Only the holder of the victims' keys could build those transactions, so the gas wallet belongs to the thief as well.
Its gas money came from just two outside wallets, in a handful of transfers on Saturday.
| Gas money into the attacker's gas wallet, 7 November (UTC) | ATOM |
|---|---|
| 09:36:11 from payout wallet 1 | 73.29 |
| 11:00:32 from payout wallet 2 | 45.70 |
| 13:49:24 from payout wallet 2 | 109.62 |
Both senders look like exchange payout wallets. One has signed more than 1.2 million transactions. Both pay the same flat 0.02 ATOM fee on every transfer and send to many different addresses. We could not confirm who runs them: neither carries a public tag, and neither is in our address labels. If either belongs to an exchange, that exchange knows which account asked for these withdrawals. It is the clearest lead to the person behind the drain.
09 · What nowWhat can still be stopped
Some of the money can still be frozen or watched. Circle, the issuer of USDC, can block an address on Noble, where the thief holds 81,006 USDC. The staked ATOM cannot be sold for 21 days unless the thief hands the share tokens to a liquid staking service. Those services can watch for tokens from the collector. Exchanges can flag the eight collector addresses and the gas wallet, all listed in the record below. If the thief bridges out, anyone can follow the funds onward with the Bitquery MCP on the chains it covers.
For victims, Keplr's advice stands. Send nothing new to a social-login account, and do not import it anywhere else. A wallet whose reward address now points at the thief keeps paying the thief, and changing that setting takes the leaked key. Any new funds belong in a new wallet with its own recovery phrase. Keplr also told users to ignore any offer to get their funds back.
10 · CheckedWhat we checked and did not find
Keplr can also hold coins on Ethereum-style chains, so we looked there. A wallet's Ethereum address can be worked out from the public key its own transactions reveal, so we did that for the largest victims. None of them sent anything on Ethereum after the drain began, and we saw no drain there.
The thief's key, written as a Bitcoin address, bc1qatuap9…ds23, has no activity in our Bitcoin data.
On 33 other Cosmos chains, including Stride, Neutron, Juno, Axelar, Sei and Kava, the thief's key holds nothing. The 39 largest victims sent nothing on Stride, Neutron or Juno after the drain began, so no second collector shows up there. We could not read 14 other chains.
One question stays open. Neither Keplr nor Web3Auth has said it moved user funds to a safe address for them, and if one of them had, these collectors would be those addresses. We think that unlikely. If either company says otherwise, we will correct the record.
11 · MethodHow we measured it
We read the eight Cosmos chains from public nodes. For each collector we pulled every transfer into it, up to 15:38 UTC on 7 November. Then we compared the total with its balance. Prices are spot prices from the same afternoon, from CoinGecko for the main coins and from the Osmosis price service for Osmosis tokens. Staking share tokens are valued at their validator's exchange rate.
A wallet here means one private key, counted once however many chains it lost funds on. We left out 45,000 "USDC" in the Cosmos Hub collector, which arrived as 45 transfers of exactly 1,000 through an unusual route, the mark of a spam token. Tokens with no market price are also left out, so the dollar total is a floor. For the Ethereum-style and Bitcoin checks we used Bitquery's own data. It is also sold as files on the Bitquery Data Store, as the Ethereum and Bitcoin datasets.
Transfers were read up to 15:38 UTC on 7 November. The Cosmos Hub drain was still running, so its figures will grow.
A wallet means one private key, counted once. The seven chains that share one collector key give an exact count of 44,041. Injective addresses use a different format, so its extra wallets are an estimate from a sample of 299 victims, between 440 and 934.
Dollar values use spot prices at 15:27 UTC on 7 November, not prices at the time of each theft. Tokens with no market price, and 45,000 likely spam USDC, are left out.
Staking share tokens are valued at their validator's exchange rate. They cannot be sold at once, so they are worth less to the attacker until they unbond.
A blockchain does not record how a wallet was created. We count every wallet that sent funds to the collecting addresses. Keplr says the affected accounts used social login.
The links between the collectors are on-chain evidence: one key on seven chains, and shared victims and shared timing on Injective. They do not identify a person.
We could not read 14 other Cosmos chains, and we checked Ethereum-style chains and Bitcoin only for the 39 largest victims.
12 · The recordAddresses behind this story
The Cosmos addresses below are not linked. Each one can be looked up on any Cosmos explorer, such as Mintscan.
FAQ
Was Keplr hacked?
Keplr says the unauthorized transactions hit social-login accounts, which run on Web3Auth. Web3Auth says it had a security issue in services used by some third parties. Neither has said how the keys were exposed. Keplr says wallets made with a recovery phrase or a hardware wallet were not affected.
Is Keplr wallet safe to use?
Keplr says wallets made with a recovery phrase or a hardware wallet were not affected, and it has paused Google and Apple login. A blockchain does not record how a wallet was created, so we cannot check that claim wallet by wallet. Every wallet we traced lost funds to the same two addresses.
How much was taken in the Keplr wallet hack?
At least $6.01M at prices on 7 November, from at least 44,041 wallets on eight Cosmos chains. The total is a floor, because tokens with no market price are left out, and the Cosmos Hub drain was still running when we measured.
What is Web3Auth?
Web3Auth is a login service for crypto apps, part of Consensys since 2025. It lets people open a wallet through social login instead of a recovery phrase. It paused its embedded wallet service on 6 November after what it called a security issue.
Can the stolen Keplr funds be frozen?
Some of them. Circle can block the attacker's USDC on Noble. Staked ATOM taken as share tokens needs 21 days to unbond before it can be sold. Most of the rest, such as OSMO, TIA and AKT, has no issuer that can freeze it, so exchanges blocking deposits from the collector addresses matters most.
What should I do if I used Google or Apple login with Keplr?
Follow Keplr's advice: send no new funds to that account, do not import it anywhere else, and ignore messages that offer recovery. Trust updates only from Keplr's own account.
Check a wallet across chains in plain English
The cross-checks in this story, on Ethereum, Base, BNB Chain, Arbitrum and Bitcoin, use Bitquery's data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask whether a wallet moved funds after a given time, or where the funds went next, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum and Bitcoin datasets.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any wallet, login service, exchange or protocol.
The findings describe transactions and balances observed on Cosmos Hub, Osmosis, Celestia, Akash, Noble, dYdX, Babylon and Injective on 6 and 7 November 2026, with cross-checks on Ethereum, Base, BNB Chain, Arbitrum and Bitcoin. Attributions come from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Keplr, Web3Auth, Consensys, MetaMask, Google, Apple, Circle, Mintscan, CoinGecko or any other named project, company or service describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices or conduct, and nothing here asserts that any named party acted unlawfully or negligently. Victims are identified by wallet address only. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.