---
title: "Keplr Cut Google and Apple Logins After Web3Auth Breach, Whale Alert Says"
published: 2026-11-09T06:33:39.097309+00:00
type: breaking_brief
scope: security
canonical: https://www.moonwire.org/insights/keplr-cut-google-and-apple-logins-after-web3auth-breach-2026-11-08.html
tags: [security, wallets, self-custody, cosmos, lightning]
---

# Keplr Cut Google and Apple Logins After Web3Auth Breach, Whale Alert Says

> The Web3Auth breach put the risk in wallet sign-in rather than an exchange vault. Keplr switched off Google and Apple logins after a breach that Whale Alert said drained about $6.01M from Cosmos wallets, and Web3Auth paused its embedded wallet service. Separately, LNbits urged operators to take Lightning Network servers offline.

## Key takeaways

- [Whale Alert](/s/XupC7b76Q8mKUN8AfHsE4A?p=a7054b72a757) reported that Keplr disabled Google and Apple logins after a Web3Auth breach drained about $6.01M from Cosmos wallets [[1]](/s/mzUQ-_sfTOGyNBjnw1KMtQ?p=a7054b72a757).
- Web3Auth said it had temporarily paused its embedded wallet service and found no evidence that MetaMask users were impacted [[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757).
- [Changpeng Zhao](/s/D9cQMahdQfy-JU_hpEnUMA?p=a7054b72a757) pointed social-login wallet users to Web3Auth's disclosure, writing "Self custody = self responsibility." [[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757)
- LNbits separately urged operators to take Lightning Network servers offline after security compromises and reported unauthorized withdrawals [[4]](/s/nBLgHaM9RsGs6qxh34eWSA?p=a7054b72a757).

The Web3Auth breach put the risk in the convenience layer of wallet sign-in rather than in an exchange's vault. Keplr disabled its Google and Apple logins after a Web3Auth security breach that [Whale Alert](/s/XupC7b76Q8mKUN8AfHsE4A?p=a7054b72a757) reported drained about $6.01M from Cosmos wallets [[1]](/s/mzUQ-_sfTOGyNBjnw1KMtQ?p=a7054b72a757).

## What happened

Web3Auth said it was aware of a security issue affecting its services used by some third parties and had temporarily paused its embedded wallet service. After an initial investigation, it said it had found "no evidence that MetaMask users are impacted" [[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757). Keplr's response, according to [Whale](https://www.moonwire.org/insights/glossary/crypto-whale.md) Alert, was to switch off its Google and Apple login options [[1]](/s/mzUQ-_sfTOGyNBjnw1KMtQ?p=a7054b72a757). Whale Alert's report put the losses in Cosmos wallets, while Web3Auth's statement addressed MetaMask users [[1]](/s/mzUQ-_sfTOGyNBjnw1KMtQ?p=a7054b72a757)[[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757).

[Changpeng Zhao](/s/D9cQMahdQfy-JU_hpEnUMA?p=a7054b72a757) pointed anyone who had used a "social login" for a crypto wallet to Web3Auth's disclosure, telling them to research it further to protect their funds, and wrote "Self [custody](https://www.moonwire.org/insights/glossary/crypto-custody.md) = self responsibility." [[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757)

## Between two kinds of trust

[Coin Bureau](/s/gW3t6pXYTIec3Hdd4gJvPg?p=a7054b72a757)'s custody explainer framed the choice as two kinds of trust: "The paper asks you to trust yourself." On the other side was a database that "asks you to trust a company, its engineers, and the laws of whichever country it calls home" [[3]](/s/2DWl8KzZRayN8_PA-6OFUg?p=a7054b72a757). The Web3Auth episode sits between the two. Zhao framed it as a [self-custody](https://www.moonwire.org/insights/glossary/self-custody.md) matter, while Keplr's access path ran through Google and Apple sign-in [[2]](/s/ti-1Z0NgQp2i7uIgyYGd2g?p=a7054b72a757)[[1]](/s/mzUQ-_sfTOGyNBjnw1KMtQ?p=a7054b72a757).

## A second compromise, a different stack

At 19:46 UTC, Whale Alert relayed that LNbits had urged operators to take Lightning Network servers offline after security compromises and reported unauthorized withdrawals [[4]](/s/nBLgHaM9RsGs6qxh34eWSA?p=a7054b72a757). Nothing in the rows cited here links the two incidents.

On the same theme of account access, KuCoin asked whether passing a liveness check is enough, citing AI-generated deepfakes and facial spoofing, and promoted its multi-layer identity verification [[5]](/s/M-hpqfFxT4q0O1JNLUfD1w?p=a7054b72a757).

---

*MoonWire surfaces and summarizes public crypto news.*

**General information only — not financial advice.** MoonWire Ltd. is not licensed by ASIC and holds no AFSL. This content does not consider your objectives, financial situation, or needs, and is not a recommendation to buy, sell, or hold any asset.

*This analysis is generated by artificial intelligence and may be inaccurate, incomplete, or fabricated. Independently verify before acting.*

© 2026 MoonWire Ltd. · [Terms](https://www.moonwire.org/legal/TOS) · [Risk Disclosure](https://www.moonwire.org/legal/RISK_DISCLOSURE) · [Privacy Policy](https://www.moonwire.org/legal/PRIVACY_POLICY)