{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets · updates",
  "home_page_url": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026",
  "feed_url": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/feed.json",
  "description": "Web3Auth (Consensys) said on Nov 6 2026 it had paused its embedded-wallet service over a security issue affecting services used by some third parties, with no evidence MetaMask users were impacted. Its status page put the Login Service into maintenance for a security incident from Nov 6 18:30 UTC. On Nov 7 Keplr reported unauthorised transactions on some wallets created with Google or Apple login, paused those social logins, and said recovery-phrase and hardware-wallet accounts are not affected. Later on Nov 7 Web3Auth said it had identified an infrastructure issue affecting certain embedded wallets used by Keplr that led to a private-key breach, and that it and partners had begun whitehat recovery transfers on vulnerable wallets not yet drained, using the same path as the original attacker. Keplr is assisting that recovery; some Google/Apple-login balances may already look reduced or empty because of those mitigation transfers. Neither vendor has published affected counts or loss totals. Users of affected social-login wallets should not send new funds there, should move remaining liquid assets to a recovery-phrase or hardware wallet, and should ignore third-party recovery DMs.",
  "language": "en",
  "_pwn": {
    "slug": "web3auth-keplr-google-apple-login-key-breach-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-07-99ef4285",
      "url": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-07-99ef4285",
      "title": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Keplr reports unauthorised transactions on some Google/Apple-login accounts, pauses those social logins, and says recovery-phrase and hardware-wallet wallets are not affected.",
      "content_text": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Keplr reports unauthorised transactions on some Google/Apple-login accounts, pauses those social logins, and says recovery-phrase and hardware-wallet wallets are not affected.\n\nSource: https://x.com/keplrwallet/status/2118926087615045807",
      "date_published": "2026-11-07T00:00:00.000Z",
      "external_url": "https://x.com/keplrwallet/status/2118926087615045807",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-07-f0fa33b0",
      "url": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-07-f0fa33b0",
      "title": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Web3Auth says it identified an infrastructure issue affecting certain embedded wallets used by Keplr, and begins whitehat recovery transfers on vulnerable wallets not yet hit, using the same path as the original attacker; Keplr assists and warns some social-login balances may already be reduced by those mitigations.",
      "content_text": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Web3Auth says it identified an infrastructure issue affecting certain embedded wallets used by Keplr, and begins whitehat recovery transfers on vulnerable wallets not yet hit, using the same path as the original attacker; Keplr assists and warns some social-login balances may already be reduced by those mitigations.\n\nSource: https://x.com/Web3Auth/status/2119110953975635985",
      "date_published": "2026-11-07T00:00:00.000Z",
      "external_url": "https://x.com/Web3Auth/status/2119110953975635985",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-06-04f1c8bd",
      "url": "https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026#2026-11-06-04f1c8bd",
      "title": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Web3Auth pauses its embedded-wallet service over a security issue affecting services used by some third parties; status page puts Login Service into maintenance for a security incident from 18:30 UTC; initial statement says no evidence MetaMask users are impacted.",
      "content_text": "Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets: Web3Auth pauses its embedded-wallet service over a security issue affecting services used by some third parties; status page puts Login Service into maintenance for a security incident from 18:30 UTC; initial statement says no evidence MetaMask users are impacted.\n\nSource: https://x.com/Web3Auth/status/2118814067359969745",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://x.com/Web3Auth/status/2118814067359969745",
      "tags": [
        "critical"
      ]
    }
  ]
}