Sign in with Apple is a convenience people reach for because it hands a service less of their data. This week it sat at the centre of a wallet failure that froze a popular crypto app’s easiest login route.
Keplr, a non-custodial wallet used across the Cosmos ecosystem, stopped accepting Google and Apple sign-ins on 7 November after holders reported transactions they never authorised. It traced the problem to Web3Auth, the third-party provider underneath its social login feature.
How the login became a key
Social login skips the recovery phrase. Keplr’s help pages explain that Google accounts receive a private key from Web3Auth through distributed key generation, which splits key creation across several parties so no single one holds the complete key. The Apple route works identically.
Web3Auth raised the alarm around 21:13 UTC on 6 November, citing a security issue affecting services used by some third parties, and paused its embedded wallet service.
Roughly one in five, and not yet counted
Josh Lee, co-founder of Chainapsis, which builds Keplr, said the incident did not start in Keplr’s code. His early estimate put the exposed share near 20% of social-login accounts. Only a fraction appear fully drained, leaving the rest potentially recoverable. Wallets made from a seed phrase or hardware device were never in scope.
Neither firm has published the number of affected accounts or a root cause. Keplr told holders of exposed accounts to stop sending funds, avoid re-importing them elsewhere, and treat recovery offers arriving by direct message as scams.
CertiK separately warned on 6 November that a refreshed DarkSword iPhone exploit kit can reach crypto wallets on unpatched handsets running iOS 18.4 through 18.7, merely from a page opened in Safari.
