Keplr has warned of unauthorized transactions affecting some wallet accounts created through Google or Apple login, according to the supplied report. The report says Keplr and Web3Auth are investigating jointly, Google and Apple login access has been suspended, and mnemonic-based and hardware-wallet accounts were initially assessed as unaffected.

Which Keplr accounts are reportedly affected right now

Based on the supplied report, the warning concerns some Keplr accounts created through Google or Apple login, rather than all Keplr wallets. This is the clearest indication for users trying to determine whether their own setup is affected.

The report also says accounts created using a mnemonic phrase or connected through a hardware wallet were initially assessed as unaffected. That narrows the reported risk, although it remains an initial assessment rather than a blanket guarantee covering every possible case.

For users with potentially affected social-login accounts, the reported guidance is specific: do not send new funds to those accounts, and do not re-import or recreate them elsewhere while the investigation continues. Google and Apple login functionality has also been suspended as part of the reported response.

Why the Google and Apple login route is treated differently

Available information points to the social-login embedded-wallet route rather than Keplr's entire wallet stack. That aligns with the report's focus on wallets created through Google or Apple login and helps explain why the warning is framed around account type rather than all users.

Search snippets from MetaMask developer documentation describe Embedded Wallets, formerly Web3Auth, as infrastructure for OAuth-based logins. A separate Web3Auth GitHub snippet describes these as social-login wallets that do not require a seed phrase. This architecture differs from mnemonic-based wallet and hardware-wallet flows, which is why the current warning distinguishes between those groups.

What remains unclear is the precise technical point of failure. Current reporting links the incident to a Web3Auth security issue affecting some third-party platforms, but does not establish whether the unauthorized transactions stemmed from a login-service issue, a recovery flow, signing infrastructure, or another part of the stack.

A related Web3Auth status-page search snippet provides one dated marker: it says Login Service was placed into maintenance mode due to a security incident from November 6, 2026 at 18:30 UTC to November 7, 2026 at 18:30 UTC. This supports the broader backdrop of service disruption, but does not by itself establish the cause of Keplr's reported unauthorized transactions.

What users can conclude from the current warning

If your Keplr account was created through Google or Apple login, the current report identifies that setup as potentially affected, so the warning applies directly to you. If your Keplr wallet was created from a mnemonic phrase or used through a hardware wallet, the same report places you outside the initially affected group.

The most useful immediate distinction is therefore the account-creation method, not the Keplr brand alone. Until Keplr or Web3Auth issues a more detailed update, the most prudent reading of the report is that this is a targeted warning concerning social-login wallet accounts, rather than confirmed evidence of a platform-wide compromise.