Keplr / Web3Auth: attacker obtained private keys of Google/Apple-login wallets and stole funds
Severity: high · Patch status: partial · Since 2026-11-06
An attacker used a security flaw in Web3Auth's infrastructure to reach private keys for some Keplr wallets created through Google or Apple sign-in; Keplr calls it a private-key breach. Neither company has said how the flaw worked, when the attacker first used it, or whether that route is closed. GoPlus estimates at least about $1 million was stolen, without explaining how it reached the figure. Web3Auth then moved other at-risk wallets into what it calls secure recovery wallets, across 11 Cosmos-family and 8 EVM chains. Bitquery first counted at least $6.01 million from more than 44,000 wallets as theft, then revised its analysis to treat the transfers as a rescue, while saying it cannot check who controls the recovery wallets; 86% of those wallets were emptied after Keplr's user warning. Keplr paused Google and Apple sign-in. Web3Auth paused its embedded wallet service, and its status page shows the Login Service in maintenance since 2026-11-06 18:30 UTC, described as due to a security incident, with a window ending 2026-11-07 18:30 UTC; on 2026-11-09 the page's component list showed all services operational, but it carried no written restoration notice. Keplr says wallets made with a recovery phrase or a hardware wallet are not affected. Web3Auth said its first investigation found no evidence that MetaMask users were affected; Consensys acquired Web3Auth in June 2025. No CVE has been issued, and the return of the moved funds has no date.
What to do
- If you created a Keplr wallet via Google/Apple login: move unstaked, unlocked funds to a recovery-phrase or hardware wallet; do not send new funds or re-import the account
- Do not trust DMs or links offering 'recovery'; follow only official Keplr/Web3Auth channels
- Check Web3Auth's published recovery address list before attributing transfers; do not assume unfamiliar destinations are the attacker
- Organisations embedding Web3Auth: verify whether your service is affected and pause social-login wallet creation until the login service is restored
- Await vendor guidance on checking account impact and fund return before further action
Sources
All live incidents on Threat Watch
