Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

What is confirmed: long-standing Dogecoin contributor Mishaboar publicly warned on Saturday, November 7, 2026, against wallets that can be set up with a Google, Apple or email account. Our assessment follows further down: anyone holding Dogecoin in such a wallet should now move to custody based on their own seed phrase.

The warning was prompted by an incident at wallet provider Keplr. Users there reported unauthorised transactions from accounts that had been created with a Google or Apple login. Web3Auth, the service provider that supplies this sign-in technically, temporarily suspended its embedded wallet service. For DOGE holders in Germany this is no footnote: beginners in particular like to set up their first wallet with a single click on "Sign in with Google", and that is exactly the group Mishaboar has in mind.

The price plays a supporting role. On Saturday evening one Dogecoin cost around $0.0716 according to CoinGecko, 1.5 percent less than 24 hours earlier. For investors, a different question matters this weekend: who actually has access to the keys to my coins?

Mishaboar on social signing: What the Dogecoin contributor wrote on Saturday

Mishaboar has for years been one of the best-known voices in the Dogecoin community and regularly comments on wallet security. On November 7 he took aim at a feature the industry calls "social signing" or "social login". His verdict, as reported by U.Today, is blunt: social signing is the feature to add to your wallet "if you hate your users".

He bases the criticism on two points. First, with such wallets part of the key backup sits in the "cloud", which in his words means on someone else's server. Second, the users of this kind of sign-in are often newcomers handling cryptocurrencies for the first time. This group is the least able to judge what risk it is taking on in exchange for an easy start.

The third point goes beyond the balance itself. A data leak, Mishaboar says, could link a user's real identity to their holdings. That shifts the debate from plain theft towards privacy, an angle missing from most reports on the Keplr incident.

Keplr and Web3Auth: The incident behind the Dogecoin warning

Keplr is a multi-chain wallet. According to U.Today, the app supports Cosmos, Bitcoin, Ethereum and Starknet, among others. The same report says Keplr received reports of unauthorised transactions on accounts created via Google or Apple. Keplr passed the case on to the Web3Auth team, and the two companies are investigating it together.

Web3Auth said it was aware of a security issue affecting services used by some third-party providers. The company then paused its service for so-called embedded wallets. An embedded wallet is one that an app builds directly into its own product, so the user needs neither separate wallet software nor a recovery phrase of their own. After an initial review, Web3Auth said it had found no indication that MetaMask users were affected.

The scale remains unclear. Neither Keplr nor Web3Auth has given a number of affected accounts or a loss figure. Estimates circulating on social media should be treated as unconfirmed. For now, the only reliable line is drawn by how an account was created: according to the companies, accounts with a Google or Apple login are affected.

Social login explained: Where the key of a wallet without a seed phrase is kept

At its core, a wallet is a private key. Whoever knows it controls the coins, regardless of the device it sits on. With a conventional wallet, your own device generates this key and displays it as a seed phrase. A seed phrase is a sequence of 12 or 24 words from which the key can be recalculated at any time. If you write it down offline, you need no third party to get back to your DOGE.

With social login, the user skips this step. Sign-in runs through an existing Google, Apple or Telegram account, or by email. In the background, the key is split into several parts that are stored in different places and only work together again at login. One part is tied to the provider account, one to the service provider's infrastructure, and often another to the device.

Convenience shifts responsibility. Security no longer depends on you alone but also on servers you can neither see nor check. If a component fails there or comes under attack, even a well-protected Google account offers little help. That is the connection Mishaboar means with "someone else's server".

The Dogecoin blockchain is public. Anyone can see how many DOGE sit at an address and where they move. A holder is protected mainly by the fact that nobody knows which address belongs to which person. A conventional wallet knows neither its user's name nor email address.

A social login wallet, by contrast, is tied from the outset to an account behind which there is a real person. If these mappings leak from a service provider, the worst case is a list linking addresses to email accounts. Whoever holds such a list knows who owns how much. That makes those affected targets for phishing emails, fake support calls and, at worst, extortion.

In the same report U.Today points to a second, unrelated danger: security researchers have described two attack tools called Coruna and DarkSword that target older iOS versions. Neither exploits a flaw in a wallet app; both use the operating system and can thereby reach wallet data on a compromised device. A current iPhone update is therefore basic equipment, regardless of how the wallet was set up.

Dogecoin since Friday: From the ETF dispute to the security question

Only on Friday evening Dogecoin made headlines with a very different story. We reported on November 6 that 21Shares terminated House of Doge's contract for the TDOG ETF. That was about fund structures and exchange partners. Since then the community debate has shifted markedly: away from institutional products and towards how retail investors hold their coins themselves.

The price shows that the market has not settled since Friday. At midday on Friday DOGE stood at $0.0726, on Saturday morning at $0.0721, as our analysis of the death cross recorded. On Saturday evening it was $0.0716 according to CoinGecko. The 24-hour range ran from $0.0715 to $0.0729. Over seven days Dogecoin lost 5.5 percent, over 30 days 13.6 percent.

A link between the security warning and the price cannot be shown, and we do not draw one. The decline began long before the Keplr incident. The key difference lies elsewhere: a falling price costs book value, a lost key costs the entire holding.

Seed phrase and hardware wallet: How to check how your DOGE are held

The first question is simple: did you ever write down 12 or 24 words when setting up your wallet? If not, and if you only sign in via Google, Apple, Telegram or an email address, you are very likely using a social login wallet. In many apps the settings contain an entry such as "Export key" or "Show recovery phrase". If neither exists, control does not rest with you alone.

The second question concerns the size of your holdings. For small amounts to try things out, the convenience may be acceptable. For anything you do not want to lose, moving is advisable. The route leads to a new wallet with a self-generated seed phrase, either as a smartphone app or, more securely, on a hardware wallet. A hardware wallet is a small device that stores the private key and signs transactions without ever exposing it to the internet. Which devices support Dogecoin and what they cost is shown in our hardware wallet comparison.

For the move itself, a simple sequence applies. First set up the new wallet and write the seed phrase on paper, never as a photo or in a cloud note. Then send a small test amount to the new DOGE address and check that it arrives. Only then does the rest follow. Under the German Federal Ministry of Finance's guidance on the taxation of crypto assets, a transfer between two of your own wallets is not a sale, so on its own it does not trigger tax. What to bear in mind when storing the words is explained in our guide How to store a seed phrase safely.

Our assessment: Social login has no place for larger DOGE holdings

In our editorial view Mishaboar is right on the substance, even if his wording is pointed. The evidence is on the table: at Keplr, according to the provider, coins drained from accounts whose keys were managed via a service provider, and Web3Auth had to halt its embedded wallet service. Accounts with their own seed phrase do not appear as affected in the reports.

In favour of such a sign-in is the easy entry, which makes a first purchase possible for many people in the first place. Against it is that the user has no way of protecting themselves if something goes wrong in the background. In our view, anyone holding larger amounts of Dogecoin carries this risk needlessly. This is explicitly not a recommendation to buy or sell. Cryptocurrencies remain risky, and a total loss is possible.

MiCA and wallets: What supervision in Germany covers and what it does not

Since the end of 2024 the EU Markets in Crypto-Assets Regulation, MiCA for short, has applied. It governs providers that hold or trade crypto assets for their customers, in Germany under the supervision of BaFin. Software and hardware wallet providers whose users control their own keys, by contrast, fall outside this framework according to the regulation's recitals.

Social login wallets sit in a grey zone. Such products advertise that users hold their coins themselves, yet they spread the key backup across service providers. In this case a victim usually has no claim against a supervised entity. Anyone who only buys and holds DOGE without wanting to manage keys is on clearer legal footing with a MiCA-licensed exchange. Which platforms hold such a licence is shown in our crypto exchange comparison.

Dogecoin custody: Without your own seed phrase, control is missing

Mishaboar's warning does not concern a flaw in the Dogecoin network itself. It concerns the way people hold their DOGE. Three steps help clarify your own position this weekend:

  1. Identify your sign-in method: Check whether your wallet has its own seed phrase or works only via a Google, Apple or email account. If you want to switch, you will find suitable devices in the hardware wallet comparison.
  2. Choose a software wallet with its own seed phrase: For smaller amounts on a smartphone, an app that generates the key on your device is enough. Our software wallet comparison offers an overview.
  3. Keep the purchase route separate: If you only hold DOGE and do not want to manage keys, use a MiCA-licensed exchange rather than a social login wallet. Providers and fees are listed in the exchange comparison.

(As of November 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about Dogecoin wallets with social login

With social login you create a wallet via a Google, Apple, Telegram or email account without writing down a seed phrase. The private key is split into parts, some of which are held by service providers.

Dogecoin contributor Mishaboar warned on November 7, 2026, against wallets with social login because part of the key backup sits on third-party servers. He added that a data leak could link a user's real identity to their DOGE holdings.

According to information so far, the unauthorised transactions at Keplr involved accounts created via Google or Apple. Accounts with their own seed phrase are not named as affected in the reports.

Under the German Federal Ministry of Finance's guidance on the taxation of crypto assets, transferring Dogecoin between two of your own wallets is not a sale and on its own does not trigger tax.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Related articles

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

More on this topic

November 3, 2026 1:45 AM

Foundation Passport: 23,000 phishing emails came from the wallet maker's own systems

Hardware wallet maker Foundation has admitted that attackers got into its backend infrastructure through a self-hosted application and sent more than 23,000 phishing emails from the company's genuine systems. According to the company, the Passport devices and private keys are untouched, but around 5,600 postal addresses are not.

October 17, 2026 7:31 PM

OpenAI agent used known seed phrases to reach 362 wallets: old test wallets are the weak point

An internal OpenAI model worked through publicly known recovery phrases and paid fees out of a wallet belonging to someone else. The damage was nil; the route of attack concerns anyone who has ever created a test phrase.

September 19, 2026 10:11 PM

North Korean Hackers Drain 7,000 Crypto Wallets: What to Check on Job Offers and Coding Tests

Seven agencies, among them Germany's BND and BfV, warn about the WaterPlum group: 30,000 infected machines, more than 7,000 drained wallets. The bait is a job offer, the trap a coding test.

September 10, 2026 1:14 PM

Phishing Email From the Real Sender Address: How to Check a Wallet Security Warning

An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

July 31, 2026 3:54 PM

594 BTC Gone in 25 Minutes: The Coldcard Flaw That Made Seed Phrases Guessable

A firmware bug from March 2021 let an attacker drain $38 million from around 500 Bitcoin wallets. Here is what broke, who is exposed and what to do now.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.

November 4, 2026 1:22 AM

Restoring a Crypto Wallet: Your Seed Phrase Gets the Coins Back

Phone gone or hardware wallet broken? Twelve or 24 words get you back to your coins. Here is how the recovery works, and where it most often fails.

August 11, 2026 1:32 PM

How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

The Coldcard case pushed the manufacturer question to the front, while barely touching on where the backup is kept. This guide places paper, steel, the passphrase and splitting methods against the BIP-39 and SLIP-0039 standards.

October 17, 2026 10:44 PM

Creating a Bitcoin wallet: the first ten minutes decide who has access

A Bitcoin wallet is set up in ten minutes, and that is precisely the danger. Which four steps every setup runs through, why the first transfer should be a test amount, and which five mistakes cost the most.

November 6, 2026 3:28 AM

Trust Wallet Phishing: Fake .cam Site Also Targets Phantom and OKX Wallet

The fake site trastwallet[.]cam imitates Trust Wallet and, once a wallet is connected, prepares transfers to fixed addresses. How to recognise the fake and what helps after an accidental signature.

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

August 24, 2026 1:22 PM

Phantom Wallet Ends Sui and Monad Support: What to Do Before the Deadlines

Phantom Wallet removes Monad from its app on August 26 and Sui on September 24. The balances are not lost, but only one of the two ways out leaves your tax position untouched.

October 19, 2026 1:14 AM

Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point

An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.

October 5, 2026 1:36 PM

Paper Wallet with a Single Key: The Printed Storage Method Compared with the Seed Phrase

A paper wallet carries a single private key on paper, and that is exactly where its weaknesses lie: printers, change, misread characters. What the storage method achieves, where it fails and how to wind up an old sheet safely.

October 2, 2026 10:36 AM

Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are

Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.

September 30, 2026 7:16 AM

Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet

The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.

September 28, 2026 10:26 AM

Phantom Wallet and Solscan: What a Solana Transfer Really Costs and Where It Fails

A transfer on Solana costs 0.000005 SOL, a new token account ties up 0.00148844 SOL once — both values measured on-chain by us today. This practical guide shows how to set up Phantom, how to get there from the exchange, how to read Solscan and what applies for tax in Germany.

August 31, 2026 7:20 AM

Browser Extensions as Wallet Thieves: How a Sports App Became a Seed Phrase Collector

In August 2026 the security firm Socket disclosed two separate campaigns: 40 confirmed malicious Firefox extensions and 19 for Chrome and Edge, all of them from the official marketplaces. Nine of them were harmless sports apps that only turned into wallet thieves through an update.

September 4, 2026 10:17 AM

Cypher Shutdown on September 6: What Users Should Know Now the Withdrawal Deadline Has Passed

Recap as of September 27, 2026: Cypher had announced it would take its app, dApp and withdrawal window offline on September 6, 2026 and end the token protocol. This article describes the situation before the deadline, how the payout worked and what our own measurement showed at the time about what was left of the CYPR token.

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

August 31, 2026 1:22 PM

Cosmostation Wallet Shutdown on September 1: What Cosmos Wallet Users Should Know Now the Deadline Has Passed

Recap as of September 27, 2026: Cosmostation had announced it would discontinue its wallet apps on September 1, 2026, leaving only the export of the recovery phrase and the private key. This article describes the situation before the deadline and how to move Cosmos holdings, including delegated ATOM.

August 23, 2026 4:36 PM

Operation ASTERIX: How a Fake Support Call Delivers a Counterfeit Wallet App

Security researchers analysed an open server on which a phone system, phishing interfaces and cloned wallet programs all came together. The largest list of numbers was the German one.

November 2, 2026 9:25 AM

Trezor Safe 5 implant reported at CryptoBilis: who needs a new wallet now

Trezor is warning everyone who has ordered from former reseller CryptoBilis since March 2026: an extra board with a cellular module in a Safe 5 is said to read the recovery phrase. Who is affected, why weighing the device does not help, and how to move to a new wallet.

October 26, 2026 12:15 AM

Coldcard class action over $140 million: what it means for owners

A proposed class action against Coldcard maker Coinkite is before a court in Ontario: a firmware flaw allegedly made recovery phrases predictable, and the claim puts the Bitcoin drained as a result at more than $140 million. What owners of an affected device should check and document now.

October 25, 2026 12:35 PM

Private key and public key: 256 bits decide who owns your coins

A private key is a secret number with 78 digits, and the public key can be calculated from it, while the way back cannot. Signature, seed and address all hang on it, and at an exchange or in your own wallet this single value decides who owns the coins.

October 13, 2026 1:16 AM

Ledger Confirms Implant in a Hardware Wallet as Reports Reach Europe: What Is Behind It

Ledger confirms an unauthorised additional circuit board in a tampered device and traces the confirmed cases to a reseller in South-East Asia. One report from European retail is still open, which makes the purchase route of your own device the criterion.

More from CryptoTicker