Web3Auth pauses embedded wallets as Keplr investigates unauthorized social-login transactions
Keplr confirmed that some Google or Apple login wallet keys were exposed through a Web3Auth infrastructure vulnerability. Web3Auth and its partners moved assets to protect vulnerable wallets. Bitquery estimated $6.01M at collector addresses on eight chains as of November 7, 15:38 UTC. The final loss remains unknown.
- Disclosed
- Nov 6, 2026
- Updated Nov 8, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Some Keplr wallets created with Google or Apple login. Keplr says recovery-phrase and hardware wallets are unaffected.
- Web3Auth · Keplr · Embedded wallets · Social login
- In the wild
- Yes
- Keplr received unauthorized transaction reports. Its co-founder reports exploitation.
What happened
Web3Auth disclosed a security issue affecting its embedded wallet service used by some third parties. Keplr reported unauthorized transactions from some wallets created with Google or Apple login. Keplr’s initial assessment excludes wallets created with a recovery phrase or used with hardware wallets. Web3Auth’s initial investigation found no evidence of impact on MetaMask users. The November 7 developer announcement repeats that assessment.
Keplr co-founder Josh Lee attributes the incident to Web3Auth and gives about 20% of Keplr’s Google or Apple login accounts as an early estimate of the potentially affected group. Lee says exploitation appears to involve a smaller share and recovery work is ongoing. The vendors have not published a final account count, loss total, entry mechanism or compensation plan.
Public copies of the original statements are available for Web3Auth, Keplr and Josh Lee.
Bitquery counted 44,041 wallets across seven chains where it could deduplicate by key. It separately counted 7,603 Injective addresses with overlap and estimated that Injective adds 440 to 934 distinct wallets based on a sample of 299. Adding the raw counts would double-count wallets. Bitquery used 15:27 UTC spot prices and tracked transactions through 15:38 UTC on November 7, when it still observed sweeps on Cosmos Hub. Its $6.01M valuation excludes unpriced and suspected spam tokens and has not been independently verified. On the seven chains deduplicated by key, Bitquery found that about 86% of the affected wallets were first swept after Keplr’s 04:38 UTC warning. The ledger does not reveal how each wallet was created or how signing keys were compromised.
The researchers traced about 1.96 million staked ATOM moved as tokenized shares. Normal unbonding takes 21 days, but the share tokens can be transferred before then. Bitquery saw no outgoing transfers from the collectors at its cutoff. The later disclosures do not establish which traced transfers were protective or how much the attacker ultimately obtained.
Web3Auth says the assets secured by its protective transfers are safe. The vendors have yet to confirm returns or publish the verified recovery addresses and account checker in the cited updates. A balance change alone cannot determine whether funds were stolen or moved for protection. Pausing social login does not revoke signing capability already obtained. Keep deposits paused, avoid re-importing affected accounts, and follow Keplr’s guidance to move any remaining liquid assets to a separate wallet.
Public copies of the later statements are available. Web3Auth infrastructure update, protective transfers, secured funds, recovery address list update, Keplr guidance.
Crime-scene timeline
Nov 6, 20:52 UTC
First transfers observed retrospectively by Bitquery
The researchers traced small transfers from ten Cosmos Hub wallets to the same collector.
Nov 6, 21:13 UTC
Web3Auth discloses an embedded wallet security issue
It paused the service used by some third parties and reported no evidence of impact on MetaMask users in its initial investigation.
Nov 7, 04:38 UTC
Keplr reports unauthorized transactions and pauses social login
Reports concern some wallets created with Google or Apple login. Keplr and Web3Auth are investigating.
Nov 7, 08:29 UTC
Keplr co-founder gives a preliminary scope estimate
Josh Lee places the origin at Web3Auth and estimates about 20% of Keplr social-login accounts may be affected. Lee says a smaller fraction appears to have been exploited.
Nov 7, 16:00 UTC
Bitquery publishes an eight-chain trace
The collectors held an estimated $6.01M as of the 15:38 UTC read. Cosmos Hub sweeps were still ongoing at that cutoff. Wallet counts represent keys and cannot be read as a count of people.
Nov 7, 16:53 UTC
Web3Auth confirms an infrastructure security issue
The provider identifies certain Keplr embedded wallets as affected and says it is working with Keplr to secure assets.
Nov 7, 17:06 UTC
Web3Auth discloses protective transfers
Web3Auth says it and its partners began moving assets from vulnerable wallets that had yet to be hit, using the same path as the attacker. It says assets it secured this way are safe and a verified list of recovery addresses is being prepared.
Nov 7, 17:17 UTC
Keplr confirms private-key exposure and issues transfer guidance
Keplr advises users to move remaining liquid assets to a wallet secured by a recovery phrase or hardware wallet. It says staked and locked assets will take longer to secure and an account checker is in development.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Web3Auth disclosurePrimaryOriginal public post read in a public copy. Confirms the service pause and the initial assessment of MetaMask user impact.
- Keplr incident noticePrimaryOriginal public post read in a public copy. Reports unauthorized transactions, affected wallet creation methods, the login pause and immediate user precautions.
- Web3Auth infrastructure updatePrimaryConfirms an infrastructure security issue affecting certain embedded wallets used by Keplr users.
- Web3Auth protective transfer threadPrimaryDescribes protective transfers using the attack path, says the secured funds are safe and announces work on a verified list of recovery addresses.
- Keplr private-key exposure and user guidancePrimaryConfirms private-key exposure for some social-login wallets and gives guidance for liquid, staked and locked assets.
- Keplr co-founder’s initial findingsPrimaryOriginal public post read in a public copy. Attributes the incident to the upstream provider and gives the early scope estimate and recovery status.
- Web3Auth Login Service maintenancePrimaryRecords security-related maintenance and says the provider will announce restoration.
- MetaMask developer announcementPrimaryConfirms the service pause and repeats the initial finding of no evidence of impact on MetaMask users.
- Bitquery original Keplr on-chain investigationPrimaryLists chain-specific collector addresses, the staking-share route and valuation, and explains cross-chain counting and attribution limits.