Keplr Wallet Security Incident: What LUNC Holders Need to Know and Who Is at Risk
A security incident involving Keplr Wallet has raised concerns among cryptocurrency users, including Terra Classic (LUNC) holders. Reports indicate that unauthorized transactions have affected certain Keplr accounts created using Google or Apple login methods.
However, not all Keplr users are affected. The reported issue appears to concern a specific account creation method, while users who created their wallets using a recovery phrase or a hardware wallet are not identified as affected by the reported incident.
For LUNC holders who use Keplr to store, send, or manage their tokens, understanding this distinction is important.
What Happened to Keplr Wallet?
The incident was linked to a security vulnerability in Web3Auth, the third party service responsible for providing Google and Apple social login functionality for certain Keplr wallets.
According to Keplr’s initial investigation, the issue originated from Web3Auth’s infrastructure rather than Keplr’s own wallet code. The vulnerability exposed private keys associated with some social login accounts, potentially allowing unauthorized parties to access and transfer funds.
Keplr acknowledged the reports on November 7, 2026, and began working with Web3Auth to investigate the incident. Both Google and Apple login functionality were temporarily suspended as a precaution.
The incident also triggered recovery efforts. Web3Auth began moving funds from vulnerable wallets that had not yet been exploited to protect them from the attacker. As a result, some users may see reduced or empty balances because of these protective transfers, rather than an additional theft.
Blockchain analytics firm Bitquery traced at least $6 million in cryptocurrency transfers involving more than 44,000 wallets. Separately, Web3Auth reported that recovered funds were being held in designated recovery addresses while it worked with Keplr on returning the assets.
Are LUNC Holders Affected?
This is an important question for the Terra Classic community.
Keplr is widely used within the Cosmos ecosystem, including by users who hold and manage LUNC and other supported digital assets.
The security incident is not specific to Terra Classic or LUNC. It concerns certain Keplr accounts created through Google or Apple login.
This means that LUNC holders using an affected social login wallet could face risks to their funds, just like users holding other supported cryptocurrencies.
However, users who created their Keplr wallets using a recovery phrase or connected a hardware wallet are not affected according to Keplr’s initial assessment.
The important distinction is how the Keplr wallet was originally created, not which cryptocurrency it holds.
Who Is Affected and Who Is Safe?
The reported incident concerns two specific categories of Keplr users.
Potentially affected users:
- Keplr wallets created using Google login.
- Keplr wallets created using Apple login.
Users not affected according to Keplr:
- Keplr wallets created using a recovery phrase.
- Keplr wallets secured through a hardware wallet.
It is important to understand that not every Google or Apple login account has necessarily lost funds. The investigation identified potentially vulnerable accounts, but only a portion had reportedly been exploited.
What Should LUNC Holders Do?
If you created your Keplr wallet using Google or Apple login, you should take precautions immediately.
- Do not deposit additional funds. Avoid sending LUNC or other cryptocurrencies to the potentially affected wallet.
- Move remaining liquid assets. Keplr advises users to transfer any remaining liquid funds to a separate wallet created with a recovery phrase or secured by a hardware wallet.
- Do not reimport or recreate the affected account. Follow Keplr’s official security instructions rather than attempting to restore the potentially compromised account elsewhere.
- Follow official announcements. Monitor updates from Keplr and Web3Auth for verified information about account checks and asset recovery.
- Watch out for recovery scams. Never share your recovery phrase or private keys with anyone claiming they can recover your funds. Be especially careful with unsolicited messages and suspicious links.
Users should also remember that staked and locked assets may require additional recovery procedures and could take longer to address.
What Does This Mean for the Terra Classic Community?
The incident highlights an important lesson for cryptocurrency users: the security of a wallet depends not only on the wallet application but also on the infrastructure and services connected to it.
Social login offers convenience because users can create and access wallets without managing a traditional recovery phrase during the initial setup. However, this incident demonstrates the risks that can arise when third party services responsible for wallet authentication and key management experience security vulnerabilities.
For LUNC holders, protecting private keys and choosing a secure wallet setup remain essential. Users should understand how their wallets are created, where their private keys are managed, and how to maintain control over their digital assets.
At this stage, the incident should not be interpreted as a compromise of the Terra Classic blockchain itself. The reported vulnerability concerns certain Keplr accounts using social login through Web3Auth, not the underlying security of the Terra Classic network.
The priority for affected users is to secure their remaining assets, follow verified recovery instructions, and avoid falling victim to additional scams.
