The encrypted wallet that allows one-click login with a Google account has been compromised. Keplr, a long-standing wallet in the Cosmos ecosystem, lets users log in directly with Google or Apple accounts without needing to manually enter a seed phrase—thanks to the third-party service Web3Auth. Now, a vulnerability has been discovered in Web3Auth’s system, and Keplr has confirmed that private keys for some users who logged in this way have been exposed. Prior incidents of unauthorized transactions had already occurred, prompting the immediate suspension of Google and Apple login options. The most alarming part? Some users opened their wallets to find their balances reduced—or completely wiped out. The official statement suggests this might be a protective measure: Keplr is assisting Web3Auth in moving assets from affected accounts to secure locations. But users can’t tell whether their funds were rescued or stolen—tools to check if an account was compromised are still under development. Accounts created with seed phrases or hardware wallets remain unaffected. Users who logged in via social accounts are advised not to deposit new funds into their original wallets and to transfer any remaining assets to seed phrase or hardware wallet accounts as soon as possible. They originally chose this method to avoid the hassle of writing down seed phrases—but now, with funds missing, they’re left waiting for someone else to tell them whether their money was stolen or saved.