Keplr / Web3Auth Wallet Security Investigation

On November 7, 2026, Keplr reported unauthorized transactions on some accounts created through Google or Apple login. It said it was investigating with Web3Auth and had paused those login options.

Web3Auth’s status notice dated November 6 says its Login Service entered maintenance because of a security incident. A November 7 MetaMask Builder Hub announcement says the embedded-wallet service was paused because of a security issue affecting services used by some third parties.

Later November 7 updates identify a Web3Auth infrastructure issue affecting certain Keplr embedded wallets. Keplr describes a vulnerability that exposed private keys for some Google- or Apple-login users.

These are dated notices. A maintenance window or a return to service does not, by itself, establish the full intrusion period, that an existing wallet is safe, or that lost assets have been recovered. Follow the providers’ latest official updates.

No. Web3Auth says it and its partners began protective recovery activities for vulnerable wallets using the attacker’s access path. Keplr says some reduced or empty balances may reflect mitigation efforts, with staked or locked assets taking longer to address.

Web3Auth cautions that an unfamiliar destination is not automatically an attacker address. Use only addresses and recovery information confirmed through official channels. Preserve the transaction records so unauthorized transfers, protective transfers, and any returned funds can be distinguished.

These company statements do not establish that a particular transfer was protective, that assets will be returned, or that a user has been reimbursed. We will assess documented losses and any recovery without assuming either theft or successful recovery from a balance change alone.

We would like to hear from wallet users and authorized business representatives who:

• Created a Keplr account with Google or Apple login and have an incident-related concern.
• Found unauthorized transfers, missing assets, or unexplained balance changes.
• Deposited or received funds during the incident period and later identified a potentially related unauthorized transfer.
• Experienced account restrictions, interrupted access, or documented costs responding to this incident.
• Used another app that identified Web3Auth in a related security notice and have concerns about that wallet or account.

Tell us what happened and when, including whether you received an update or reimbursement. A login failure, market-price decline, or suspicious transaction alone does not establish an incident-related loss. An inquiry does not establish exposure, a legal claim, class membership, or an entitlement to compensation.

Keep your existing transaction history, transaction hashes, network names, token amounts, approximate transfer times and time zones, notices, support correspondence, and records of response costs. Note how the wallet was originally created and when you first noticed a problem. Preserve deposit records and any refunds, credits, recoveries, or reimbursements so losses can be assessed without duplicate recovery.

Start by describing records you are authorized to access. Do not send recovery or seed phrases, private keys, keystore files, passwords, authentication codes, government identification, confidential customer records, or other people’s personal information in an initial inquiry. Public addresses and transaction hashes can reveal financial history; we can discuss what is needed and an appropriate way to provide it.