Keplr Just Killed Google and Apple Login: Social Users Told to Stop Moving Funds Now
Keplr, one of the most widely used wallets in the Cosmos ecosystem, has disabled Google and Apple login options after users reported unauthorized transactions hitting their accounts.
The wallet confirmed the suspension in an official statement, telling social-login users to immediately stop sending funds to their accounts while the team investigates. That is not a drill. If you log into Keplr with a Google or Apple account, your wallet is effectively in a danger zone until further notice.
Who Is Actually at Risk
Keplr was quick to draw a hard line in its initial assessment: seed-phrase accounts and hardware wallet users are reported to be unaffected. The vulnerability, whatever its origin, appears isolated to the social login flow, the feature that lets users skip the seed-phrase setup entirely by authenticating through Google or Apple.
That convenience is now the problem. Social login abstracts private key management away from the user, which means the security model is fundamentally different from a traditional wallet. When something breaks in that abstraction layer, users have far less control and far fewer options.
Why This Matters Beyond Keplr
Social login wallets have been one of the biggest onboarding trends in crypto over the past two years. The pitch is simple: remove the seed phrase, lower the barrier, bring in the next wave of users. Projects across Ethereum, Solana, and Cosmos have leaned hard into this model.
This incident is a stress test for that entire thesis. If a major wallet suspends social login after unauthorized transactions, it raises uncomfortable questions about every protocol running a similar authentication stack. The ecosystem does not yet know the root cause, and that uncertainty is the most dangerous part right now.
What Investigators Are Looking At
Keplr has not disclosed the attack vector, the number of affected accounts, or the total value of unauthorized transactions. Those are three very important unknowns. Until official findings are published, the blast radius is impossible to size. That alone should make every Cosmos ecosystem participant pay attention.
What You Should Do Right Now
If you use Keplr with Google or Apple login, stop depositing or sending funds immediately, exactly as the team advised. Move assets to a seed-phrase wallet or hardware wallet if you can do so safely. If you are unsure whether your account type is affected, assume the worst until Keplr provides a full post-mortem.
Watch Keplr's official channels closely. The next 24 to 48 hours will determine whether this is a contained incident or something with wider implications for social-login infrastructure across the entire space.