Keplr wallet halts social logins after 6 million dollar exploit

The popular Cosmos ecosystem wallet, Keplr, has taken emergency action by suspending all Google and Apple account integrations. This move follows a sophisticated security breach that resulted in the unauthorized drainage of approximately 6 million dollars in user funds. Developers confirmed the vulnerability originated from a flaw in the third party authentication process, which allowed attackers to bypass standard security protocols and access private keys linked to these social logins.

Security researchers tracking the incident noted that the exploit appears to be highly targeted. Affected users reported that their assets were moved rapidly across the Cosmos network before being routed through various mixing services to obfuscate the trail. The Keplr team is currently working with forensic investigators to trace the stolen assets and determine exactly how the authentication bypass was achieved.

For the time being, users are strictly advised to avoid using social account logins for any wallet operations. The development team has urged everyone to switch to mnemonic phrase backups or hardware wallet signatures to ensure their digital assets remain secure. This incident serves as a harsh reminder of the risks associated with relying on centralized identity providers for decentralized financial tools.

While the team works on a fix, the broader Cosmos community has expressed concern regarding the safety of cross chain interactions. Many traders are now moving their holdings into cold storage solutions until the wallet provider issues a security patch. The 6 million dollar drain marks one of the most significant security failures for the Cosmos ecosystem in 2026, forcing a revaluation of how authentication is handled at the wallet level.

Further updates are expected as the investigation continues. Keplr has promised to provide a full post mortem report once the system is fully stabilized and the vulnerability has been permanently closed. Until then, the suspension of social logins will remain in effect to prevent further unauthorized access to user accounts and their associated tokens.