Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets
Web3Auth embedded wallets (used by Keplr Google/Apple login)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Web3Auth (Consensys) said on Nov 6 2026 it had paused its embedded-wallet service over a security issue affecting services used by some third parties, with no evidence MetaMask users were impacted. Its status page put the Login Service into maintenance for a security incident from Nov 6 18:30 UTC. On Nov 7 Keplr reported unauthorised transactions on some wallets created with Google or Apple login, paused those social logins, and said recovery-phrase and hardware-wallet accounts are not affected. Later on Nov 7 Web3Auth said it had identified an infrastructure issue affecting certain embedded wallets used by Keplr that led to a private-key breach, and that it and partners had begun whitehat recovery transfers on vulnerable wallets not yet drained, using the same path as the original attacker. Keplr is assisting that recovery; some Google/Apple-login balances may already look reduced or empty because of those mitigation transfers. Neither vendor has published affected counts or loss totals. Users of affected social-login wallets should not send new funds there, should move remaining liquid assets to a recovery-phrase or hardware wallet, and should ignore third-party recovery DMs.
Why this severity: Private keys for some social-login embedded wallets were exposed; unauthorised drains occurred and whitehat recovery is still moving funds
- Started
- Nov 6, 2026
Affected
- Some Keplr wallets created with Google or Apple (Web3Auth) login; recovery-phrase and hardware-wallet accounts not affected per Keplr; MetaMask users not evidenced as impacted per Web3Auth
Fixed in
- Embedded wallet / Login Service paused; Keplr paused Google/Apple login; whitehat recovery ongoing; no public fixed release or full root-cause write-up yet
Timeline3
Keplr reports unauthorised transactions on some Google/Apple-login accounts, pauses those social logins, and says recovery-phrase and hardware-wallet wallets are not affected.
Web3Auth says it identified an infrastructure issue affecting certain embedded wallets used by Keplr, and begins whitehat recovery transfers on vulnerable wallets not yet hit, using the same path as the original attacker; Keplr assists and warns some social-login balances may already be reduced by those mitigations.
Web3Auth pauses its embedded-wallet service over a security issue affecting services used by some third parties; status page puts Login Service into maintenance for a security incident from 18:30 UTC; initial statement says no evidence MetaMask users are impacted.
Advisories6
- Web3Auth: security issue affecting services used by some third parties; embedded wallet pausedWeb3Auth · Nov 6, 2026
- Web3Auth Status: Login Service maintenance due to a security incidentWeb3Auth Status · Nov 6, 2026
- Keplr: unauthorised transactions on some Google/Apple-login accounts; social login pausedKeplr Wallet · Nov 7, 2026
- Web3Auth: infrastructure issue affecting certain Keplr embedded wallets; whitehat recoveryWeb3Auth · Nov 7, 2026
- Keplr: assisting Web3Auth recovery after private-key breach of some Google/Apple-login walletsKeplr Wallet · Nov 7, 2026
- A security incident with Web3Auth Embedded WalletsMetaMask Builder forum (Web3Auth) · Nov 7, 2026
News & write-ups1
Posts5
We're aware of a security issue affecting Web3Auth's services used by some third parties. We have temporarily paused the embedded wallet service. After an initial investigation, we've found no evidence that MetaMask users are impacted.
We have received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login. We flagged this to the @Web3Auth team and have been working with them on the investigation since. Based on our initial assessment: if you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected. If you created your Keplr account with Google or Apple login, your account may be affected. While we investigate: – Do not send new funds to that account. – Do not re-import or recreate it anywhere. – Google/Apple login is paused for now. – Trust updates only from this account. Ignore DMs or links offering “recovery”. We will share verified details and next steps here as soon as we have them.
Following our earlier update, we have identified a security issue in Web3Auth infrastructure affecting certain embedded wallets used by Keplr.
As part of the security response relating to the incident affecting certain Keplr wallets, we, in connection with our partners, began whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker.
What this means for Keplr users If you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected. In response to Web3Auth’s infrastructure vulnerability leading to private key breach some Keplr users who signed in with Google or Apple, we are assisting the Web3Auth team’s effort to secure and protect assets from affected users. This is ongoing. Staked and locked assets add complexity and take longer. This means some Google/Apple-login accounts may already show a reduced or empty balance as a result of these mitigation efforts. If you created your Keplr account with Google or Apple login, your account may be affected: – Do not send new funds to that account. – Move any remaining liquid assets to a recovery-phrase or hardware-wallet account. We are working with Web3Auth on a way to check whether your account is affected. Only trust updates from this account or @Web3Auth. Ignore DMs or links offering “recovery”.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
