Dogecoin news: Why Mishaboar warns against social login wallets

What is confirmed: long-standing Dogecoin contributor Mishaboar publicly warned on Saturday, November 7, 2026, against wallets that can be set up with a Google, Apple or email account. Our assessment follows further down: anyone holding Dogecoin in such a wallet should now move to custody based on their own seed phrase.

The warning was prompted by an incident at wallet provider Keplr. Users there reported unauthorised transactions from accounts that had been created with a Google or Apple login. Web3Auth, the service provider that supplies this sign-in technically, temporarily suspended its embedded wallet service. For DOGE holders in Germany this is no footnote: beginners in particular like to set up their first wallet with a single click on "Sign in with Google", and that is exactly the group Mishaboar has in mind.

The price plays a supporting role. On Saturday evening one Dogecoin cost around $0.0716 according to CoinGecko, 1.5 percent less than 24 hours earlier. For investors, a different question matters this weekend: who actually has access to the keys to my coins?

Mishaboar on social signing: What the Dogecoin contributor wrote on Saturday

Mishaboar has for years been one of the best-known voices in the Dogecoin community and regularly comments on wallet security. On November 7 he took aim at a feature the industry calls "social signing" or "social login". His verdict, as reported by U.Today, is blunt: social signing is the feature to add to your wallet "if you hate your users".

He bases the criticism on two points. First, with such wallets part of the key backup sits in the "cloud", which in his words means on someone else's server. Second, the users of this kind of sign-in are often newcomers handling cryptocurrencies for the first time. This group is the least able to judge what risk it is taking on in exchange for an easy start.

The third point goes beyond the balance itself. A data leak, Mishaboar says, could link a user's real identity to their holdings. That shifts the debate from plain theft towards privacy, an angle missing from most reports on the Keplr incident.

Keplr and Web3Auth: The incident behind the Dogecoin warning

Keplr is a multi-chain wallet. According to U.Today, the app supports Cosmos, Bitcoin, Ethereum and Starknet, among others. The same report says Keplr received reports of unauthorised transactions on accounts created via Google or Apple. Keplr passed the case on to the Web3Auth team, and the two companies are investigating it together.

Web3Auth said it was aware of a security issue affecting services used by some third-party providers. The company then paused its service for so-called embedded wallets. An embedded wallet is one that an app builds directly into its own product, so the user needs neither separate wallet software nor a recovery phrase of their own. After an initial review, Web3Auth said it had found no indication that MetaMask users were affected.

The scale remains unclear. Neither Keplr nor Web3Auth has given a number of affected accounts or a loss figure. Estimates circulating on social media should be treated as unconfirmed. For now, the only reliable line is drawn by how an account was created: according to the companies, accounts with a Google or Apple login are affected.

Social login explained: Where the key of a wallet without a seed phrase is kept

At its core, a wallet is a private key. Whoever knows it controls the coins, regardless of the device it sits on. With a conventional wallet, your own device generates this key and displays it as a seed phrase. A seed phrase is a sequence of 12 or 24 words from which the key can be recalculated at any time. If you write it down offline, you need no third party to get back to your DOGE.

With social login, the user skips this step. Sign-in runs through an existing Google, Apple or Telegram account, or by email. In the background, the key is split into several parts that are stored in different places and only work together again at login. One part is tied to the provider account, one to the service provider's infrastructure, and often another to the device.

Convenience shifts responsibility. Security no longer depends on you alone but also on servers you can neither see nor check. If a component fails there or comes under attack, even a well-protected Google account offers little help. That is the connection Mishaboar means with "someone else's server".

Wallet privacy: Why a leak links your identity to your DOGE holdings

The Dogecoin blockchain is public. Anyone can see how many DOGE sit at an address and where they move. A holder is protected mainly by the fact that nobody knows which address belongs to which person. A conventional wallet knows neither its user's name nor email address.

A social login wallet, by contrast, is tied from the outset to an account behind which there is a real person. If these mappings leak from a service provider, the worst case is a list linking addresses to email accounts. Whoever holds such a list knows who owns how much. That makes those affected targets for phishing emails, fake support calls and, at worst, extortion.

In the same report U.Today points to a second, unrelated danger: security researchers have described two attack tools called Coruna and DarkSword that target older iOS versions. Neither exploits a flaw in a wallet app; both use the operating system and can thereby reach wallet data on a compromised device. A current iPhone update is therefore basic equipment, regardless of how the wallet was set up.

Dogecoin since Friday: From the ETF dispute to the security question

Only on Friday evening Dogecoin made headlines with a very different story. We reported on November 6 that 21Shares terminated House of Doge's contract for the TDOG ETF. That was about fund structures and exchange partners. Since then the community debate has shifted markedly: away from institutional products and towards how retail investors hold their coins themselves.

The price shows that the market has not settled since Friday. At midday on Friday DOGE stood at $0.0726, on Saturday morning at $0.0721, as our analysis of the death cross recorded. On Saturday evening it was $0.0716 according to CoinGecko. The 24-hour range ran from $0.0715 to $0.0729. Over seven days Dogecoin lost 5.5 percent, over 30 days 13.6 percent.

A link between the security warning and the price cannot be shown, and we do not draw one. The decline began long before the Keplr incident. The key difference lies elsewhere: a falling price costs book value, a lost key costs the entire holding.

Seed phrase and hardware wallet: How to check how your DOGE are held

The first question is simple: did you ever write down 12 or 24 words when setting up your wallet? If not, and if you only sign in via Google, Apple, Telegram or an email address, you are very likely using a social login wallet. In many apps the settings contain an entry such as "Export key" or "Show recovery phrase". If neither exists, control does not rest with you alone.

The second question concerns the size of your holdings. For small amounts to try things out, the convenience may be acceptable. For anything you do not want to lose, moving is advisable. The route leads to a new wallet with a self-generated seed phrase, either as a smartphone app or, more securely, on a hardware wallet. A hardware wallet is a small device that stores the private key and signs transactions without ever exposing it to the internet. Which devices support Dogecoin and what they cost is shown in our hardware wallet comparison.

For the move itself, a simple sequence applies. First set up the new wallet and write the seed phrase on paper, never as a photo or in a cloud note. Then send a small test amount to the new DOGE address and check that it arrives. Only then does the rest follow. Under the German Federal Ministry of Finance's guidance on the taxation of crypto assets, a transfer between two of your own wallets is not a sale, so on its own it does not trigger tax. What to bear in mind when storing the words is explained in our guide How to store a seed phrase safely.

Our assessment: Social login has no place for larger DOGE holdings

In our editorial view Mishaboar is right on the substance, even if his wording is pointed. The evidence is on the table: at Keplr, according to the provider, coins drained from accounts whose keys were managed via a service provider, and Web3Auth had to halt its embedded wallet service. Accounts with their own seed phrase do not appear as affected in the reports.

In favour of such a sign-in is the easy entry, which makes a first purchase possible for many people in the first place. Against it is that the user has no way of protecting themselves if something goes wrong in the background. In our view, anyone holding larger amounts of Dogecoin carries this risk needlessly. This is explicitly not a recommendation to buy or sell. Cryptocurrencies remain risky, and a total loss is possible.

MiCA and wallets: What supervision in Germany covers and what it does not

Since the end of 2024 the EU Markets in Crypto-Assets Regulation, MiCA for short, has applied. It governs providers that hold or trade crypto assets for their customers, in Germany under the supervision of BaFin. Software and hardware wallet providers whose users control their own keys, by contrast, fall outside this framework according to the regulation's recitals.

Social login wallets sit in a grey zone. Such products advertise that users hold their coins themselves, yet they spread the key backup across service providers. In this case a victim usually has no claim against a supervised entity. Anyone who only buys and holds DOGE without wanting to manage keys is on clearer legal footing with a MiCA-licensed exchange. Which platforms hold such a licence is shown in our crypto exchange comparison.

Dogecoin custody: Without your own seed phrase, control is missing

Mishaboar's warning does not concern a flaw in the Dogecoin network itself. It concerns the way people hold their DOGE. Three steps help clarify your own position this weekend:

1. Identify your sign-in method: Check whether your wallet has its own seed phrase or works only via a Google, Apple or email account. If you want to switch, you will find suitable devices in the hardware wallet comparison.
2. Choose a software wallet with its own seed phrase: For smaller amounts on a smartphone, an app that generates the key on your device is enough. Our software wallet comparison offers an overview.
3. Keep the purchase route separate: If you only hold DOGE and do not want to manage keys, use a MiCA-licensed exchange rather than a social login wallet. Providers and fees are listed in the exchange comparison.

(As of November 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)