Audit log

Every state-changing event for Keplr Wallet: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-11-11 04:12:46Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 467,984,898

   sig

   3SGcx9nLDt3z…1xufiNcUcopyexplorer ↗

   hash

   DYMX5CQEzsq3…NJJRUQfncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (10682 B) ▸

   {"actor":"system:backfill","investigation_id":"f16cd509-f79c-486f-a11d-ab133d3ed9c8","kind":"publish","page_slug":"keplr-wallet","published_at":"2026-11-11T04:12:45.840Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Keplr Wallet","sections":[{"content":"Keplr Wallet is a browser-extension and mobile wallet built by Chainapsis, an interchain infrastructure company led by co-founders Josh Lee and Tony Yun, for the Cosmos SDK / IBC ecosystem. The wallet is open source under an Apache 2.0 license, with some submodules reported as closed source. Keplr has been described as supporting more than 2 million users as of 2025. In addition to standard recovery-phrase and hardware-wallet (e.g., Ledger) account creation, Keplr offered 'social login' account creation via Google and Apple, implemented using embedded-wallet infrastructure from the third-party provider Web3Auth, which was acquired by Consensys in June 2025.","heading":"Background","severity":"low","sources":[{"credibility":2,"name":"What's ahead for Chainapsis & Keplr in 2021 (Chainapsis/Keplr blog)","type":"official","url":"https://blog.keplr.app/whats-ahead-for-chainapsis-keplr-in-2021/"},{"credibility":1,"name":"Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"How Keplr pioneered social logins for Web3 wallets way before it was cool (Web3Auth blog)","type":"official","url":"https://blog.web3auth.io/how-keplr-pioneered-social-logins-for-web3-wallets-way-before-it-was-cool/"}]},{"content":"Beginning around November 6, 2026, Web3Auth disclosed a security flaw in the infrastructure underlying its embedded-wallet service, which Keplr used to let users create wallets via Google or Apple sign-in instead of a seed phrase. Users reported unauthorized transactions draining funds from accounts created this way, and Keplr suspended both Google and Apple login creation in response. Keplr co-founder Josh Lee stated the issue 'was not a hack of Keplr's code' and that it 'originated at Web3Auth, a provider Keplr uses,' estimating that roughly 20% of Keplr accounts created via Google or Apple login were potentially affected, though he said 'only a fraction of that 20% has actually been exploited.' Keplr said accounts created with a recovery phrase or hardware wallet were not affected. On-chain analytics firm Bitquery reported that a thief collected approximately $6.01 million from more than 44,000 affected private keys/wallets across multiple Cosmos chains, with Cosmos Hub accounting for roughly $3.5 million, Osmosis about $1.04 million, and Injective about $615,000; the firm noted the median affected wallet lost about $1.34, while the largest single transfer approached $325,000, and that roughly 1.96 million staked ATOM was moved, bypassing the network's normal 21-day unstaking period.","heading":"Security Incident: Web3Auth Social-Login Breach (November 2026)","severity":"critical","sources":[{"credibility":1,"name":"Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"Keplr Wallet Breach Triggers $6 Million in Transfers Across Cosmos","type":"news_article","url":"https://news.bitcoin.com/security/keplr-wallet-breach-triggers-6-million-in-transfers-across-cosmos/"},{"credibility":2,"name":"Keplr Wallet Hack: Google, Apple login","type":"news_article","url":"https://crypto.news/keplr-wallet-hack-web3auth-google-apple-login/"},{"credibility":2,"name":"Keplr Wallet halts Google and Apple login after Web3Auth flaw drains accounts","type":"news_article","url":"https://cryptoticker.io/en/keplr-wallet-web3auth-social-login-exploit/"}]},{"content":"Web3Auth said it ran a 'white-hat' recovery operation, moving assets out of vulnerable wallets the attacker had not yet reached and consolidating them into 12 addresses that, as of November 8, 2026, held approximately $5.6 million in recovered funds, including roughly 2.49 million ATOM (about $3.3 million) on Cosmos Hub. Web3Auth stated: 'Funds recovered through this process are safe, and we are working with Keplr on a path to recovery for users,' and separately said 'we are aware that some of these transactions have been mistaken for attacker activity.' Reporting noted that all eight addresses Bitquery had attributed to the alleged thief were on Web3Auth's own recovery-wallet list, meaning the widely cited $6 million figure may substantially overlap with funds Web3Auth itself moved for safekeeping rather than confirmed, irrecoverable theft. As of the most recent reporting reviewed (November 8, 2026), neither company had published a precise technical root-cause explanation, a final verified loss total, or a reimbursement process for users whose accounts show reduced or empty balances. Keplr advised affected Google/Apple-login users not to deposit further funds, to move any remaining balances to a recovery-phrase or hardware wallet, and to disregard unsolicited third-party 'recovery' offers.","heading":"Response, Mitigation, and Disputed Loss Figures","severity":"high","sources":[{"credibility":1,"name":"Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"Keplr Wallet Breach Triggers $6 Million in Transfers Across Cosmos","type":"news_article","url":"https://news.bitcoin.com/security/keplr-wallet-breach-triggers-6-million-in-transfers-across-cosmos/"}]},{"content":"As of the most recent sources reviewed, it remained unconfirmed how many Keplr social-login accounts suffered irrecoverable losses versus having funds moved into Web3Auth's protective custody, whether and how affected users would be reimbursed, and the precise technical vulnerability that allowed private-key exposure. These points should be treated as alleged and unresolved pending further official disclosures from Keplr/Chainapsis and Web3Auth/Consensys.","heading":"Unresolved Questions","severity":"medium","sources":[{"credibility":1,"name":"Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"}]}],"sources_used":[{"credibility":1,"name":"Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets","type":"news_article","url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"credibility":2,"name":"Keplr Wallet Breach Triggers $6 Million in Transfers Across Cosmos","type":"news_article","url":"https://news.bitcoin.com/security/keplr-wallet-breach-triggers-6-million-in-transfers-across-cosmos/"},{"credibility":2,"name":"Keplr Wallet Hack: Google, Apple login","type":"news_article","url":"https://crypto.news/keplr-wallet-hack-web3auth-google-apple-login/"},{"credibility":2,"name":"Keplr Wallet halts Google and Apple login after Web3Auth flaw drains accounts","type":"news_article","url":"https://cryptoticker.io/en/keplr-wallet-web3auth-social-login-exploit/"},{"credibility":2,"name":"What's ahead for Chainapsis & Keplr in 2021 (Chainapsis/Keplr blog)","type":"official","url":"https://blog.keplr.app/whats-ahead-for-chainapsis-keplr-in-2021/"},{"credibility":2,"name":"How Keplr pioneered social logins for Web3 wallets way before it was cool (Web3Auth blog)","type":"official","url":"https://blog.web3auth.io/how-keplr-pioneered-social-logins-for-web3-wallets-way-before-it-was-cool/"}],"summary":"Keplr Wallet is a non-custodial, open-source browser and mobile wallet for the Cosmos/IBC ecosystem, developed by Chainapsis and co-founded by Josh Lee and Tony Yun. In early November 2026, Keplr suspended Google and Apple social-login account creation after a security flaw at its embedded-wallet provider, Web3Auth (owned by Consensys), allegedly exposed private keys of social-login accounts, leading to unauthorized transfers reported at roughly $6 million across multiple Cosmos chains. Keplr says standard recovery-phrase and hardware-wallet accounts were not affected, and the companies dispute how much of the reported total reflects theft versus funds moved into protective custody by Web3Auth.","timeline":[{"date":"2026-06","event":"Consensys acquires Web3Auth, the embedded-wallet/social-login provider later linked to the Keplr incident.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"date":"2026-11","date_evidence":"Nov. 6: Web3Auth disclosed a security issue affecting infrastructure used by third-party services. Nov. 6-7: Keplr reported unauthorized transactions involving accounts created with Google or Apple logins and suspended both login methods.","date_original":"2026-11-06","event":"Web3Auth discloses a security flaw in its embedded-wallet infrastructure; Keplr reports unauthorized transactions from Google/Apple login accounts and suspends both login methods.","source":"Bitcoin.com News","source_url":"https://news.bitcoin.com/security/keplr-wallet-breach-triggers-6-million-in-transfers-across-cosmos/"},{"date":"2026-11","event":"Bitquery reports an alleged thief collected approximately $6.01 million from more than 44,000 affected Keplr wallets across multiple Cosmos chains; Web3Auth begins moving funds from vulnerable wallets into recovery addresses.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"},{"date":"2026-11-08","date_evidence":"Sunday, Nov. 8, 2026: Web3Auth published 12 recovery addresses holding about $5.6 million, per onchain data reviewed by The Block.","event":"Web3Auth publishes 12 recovery addresses holding approximately $5.6 million in funds moved from vulnerable wallets; disputes the scale of the Bitquery-reported figure.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0c9e6b41-2fbc-4f25-b317-08dc4e61db45copy