# Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets · pwn.watch > Web3Auth (Consensys) said on Nov 6 2026 it had paused its embedded-wallet service over a security issue affecting services used by some third parties, with no evidence MetaMask users were impacted. Its status page put the Login Service into maintenance for a security incident from Nov 6 18:30 UTC. On Nov 7 Keplr reported unauthorised transactions on some wallets created with Google or Apple login, paused those social logins, and said recovery-phrase and hardware-wallet accounts are not affected. Later on Nov 7 Web3Auth said it had identified an infrastructure issue affecting certain embedded wallets used by Keplr that led to a private-key breach, and that it and partners had begun whitehat recovery transfers on vulnerable wallets not yet drained, using the same path as the original attacker. Keplr is assisting that recovery; some Google/Apple-login balances may already look reduced or empty because of those mitigation transfers. Neither vendor has published affected counts or loss totals. Users of affected social-login wallets should not send new funds there, should move remaining liquid assets to a recovery-phrase or hardware wallet, and should ignore third-party recovery DMs. Page: https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026 · generated 2026-11-07T22:05:00.636Z ## Status - Severity: critical · status: live · patch: partial - Product: Web3Auth embedded wallets (used by Keplr Google/Apple login) - Started: 2026-11-06 - Affected: Some Keplr wallets created with Google or Apple (Web3Auth) login; recovery-phrase and hardware-wallet accounts not affected per Keplr; MetaMask users not evidenced as impacted per Web3Auth - Fixed in: Embedded wallet / Login Service paused; Keplr paused Google/Apple login; whitehat recovery ongoing; no public fixed release or full root-cause write-up yet ## Follow this incident - RSS (one item per update): https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026.json - This file: https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: Keplr reports unauthorised transactions on some Google/Apple-login accounts, pauses those social logins, and says recovery-phrase and hardware-wallet wallets are not affected. (https://x.com/keplrwallet/status/2118926087615045807) - 2026-11-07: Web3Auth says it identified an infrastructure issue affecting certain embedded wallets used by Keplr, and begins whitehat recovery transfers on vulnerable wallets not yet hit, using the same path as the original attacker; Keplr assists and warns some social-login balances may already be reduced by those mitigations. (https://x.com/Web3Auth/status/2119110953975635985) - 2026-11-06: Web3Auth pauses its embedded-wallet service over a security issue affecting services used by some third parties; status page puts Login Service into maintenance for a security incident from 18:30 UTC; initial statement says no evidence MetaMask users are impacted. (https://x.com/Web3Auth/status/2118814067359969745) ## Fix brief # Security brief: Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets Source: https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026 · status: live · severity: critical · updated Nov 7, 2026, 21:29 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Web3Auth (Consensys) said on Nov 6 2026 it had paused its embedded-wallet service over a security issue affecting services used by some third parties, with no evidence MetaMask users were impacted. Its status page put the Login Service into maintenance for a security incident from Nov 6 18:30 UTC. On Nov 7 Keplr reported unauthorised transactions on some wallets created with Google or Apple login, paused those social logins, and said recovery-phrase and hardware-wallet accounts are not affected. Later on Nov 7 Web3Auth said it had identified an infrastructure issue affecting certain embedded wallets used by Keplr that led to a private-key breach, and that it and partners had begun whitehat recovery transfers on vulnerable wallets not yet drained, using the same path as the original attacker. Keplr is assisting that recovery; some Google/Apple-login balances may already look reduced or empty because of those mitigation transfers. Neither vendor has published affected counts or loss totals. Users of affected social-login wallets should not send new funds there, should move remaining liquid assets to a recovery-phrase or hardware wallet, and should ignore third-party recovery DMs. Severity detail: Private keys for some social-login embedded wallets were exposed; unauthorised drains occurred and whitehat recovery is still moving funds - Product: Web3Auth embedded wallets (used by Keplr Google/Apple login) ## Affected versions - Some Keplr wallets created with Google or Apple (Web3Auth) login; recovery-phrase and hardware-wallet accounts not affected per Keplr; MetaMask users not evidenced as impacted per Web3Auth ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Embedded wallet / Login Service paused; Keplr paused Google/Apple login; whitehat recovery ongoing; no public fixed release or full root-cause write-up yet After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Keplr Google/Apple-login users: do not send new funds to that account; move remaining liquid assets to a recovery-phrase or hardware wallet; ignore DMs/links offering recovery; trust only @keplrwallet and @Web3Auth. Seed-phrase and hardware wallets are not affected per Keplr. MetaMask users: Web3Auth says no evidence of impact. Other apps embedding Web3Auth social login may be in scope once vendors confirm — watch official channels. ## Latest updates - Nov 7, 2026: Keplr reports unauthorised transactions on some Google/Apple-login accounts, pauses those social logins, and says recovery-phrase and hardware-wallet wallets are not affected. - Nov 7, 2026: Web3Auth says it identified an infrastructure issue affecting certain embedded wallets used by Keplr, and begins whitehat recovery transfers on vulnerable wallets not yet hit, using the same path as the original attacker; Keplr assists and warns some social-login balances may already be reduced by those mitigations. - Nov 6, 2026: Web3Auth pauses its embedded-wallet service over a security issue affecting services used by some third parties; status page puts Login Service into maintenance for a security incident from 18:30 UTC; initial statement says no evidence MetaMask users are impacted. ## Advisories - [Web3Auth: security issue affecting services used by some third parties; embedded wallet paused](https://x.com/Web3Auth/status/2118814067359969745) (Web3Auth) - [Web3Auth Status: Login Service maintenance due to a security incident](https://status.web3auth.io/) (Web3Auth Status) - [Keplr: unauthorised transactions on some Google/Apple-login accounts; social login paused](https://x.com/keplrwallet/status/2118926087615045807) (Keplr Wallet) - [Web3Auth: infrastructure issue affecting certain Keplr embedded wallets; whitehat recovery](https://x.com/Web3Auth/status/2119110953975635985) (Web3Auth) - [Keplr: assisting Web3Auth recovery after private-key breach of some Google/Apple-login wallets](https://x.com/keplrwallet/status/2119117067500806350) (Keplr Wallet) - [A security incident with Web3Auth Embedded Wallets](https://builder.metamask.io/t/a-security-incident-with-web3auth-embedded-wallets/3663) (MetaMask Builder forum (Web3Auth)) ## Write-ups & news - [Web3Auth security incident hits Keplr wallets made with Google login](https://cybersixt.com/originals/web3auth-security-incident-hits-keplr-wallets-made-with-google-login) --- Machine-readable: https://pwn.watch/i/web3auth-keplr-google-apple-login-key-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.