Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety Swati KhandelwalNov 09, 2026Cryptocurrency / Vulnerability Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, it said. It moved that money, with help from the wallet maker, into recovery wallets for safekeeping. So an empty balance may mean the money was rescued, not stolen. Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected, the wallet maker said. It has paused Google and Apple sign-in while it investigates. The wallet maker has given this user guidance for accounts created with Google or Apple login: Do not re-import the account or recreate it anywhere. Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet. Trust updates only from the official accounts of the wallet maker and the login provider, and ignore direct messages or links that offer "recovery." Staked and locked assets are taking longer to secure. The wallet maker is also working with the login provider on a way for users to check whether their account was affected. In the meantime, the login provider has published a recovery address list, which it says lets people tell its own transfers apart from possibly malicious ones. It has also warned users not to assume that an unfamiliar destination address is linked to the attacker. In an incident update, Web3Auth said a security issue in its own infrastructure affected certain wallets it provides inside the Keplr app. Keplr went further, saying the flaw led to a "private key breach" for some users who signed in with Google or Apple. A private key is the secret code that approves payments from a wallet, so whoever holds it can move the money. Neither company has said how the flaw worked, when the attacker first used it, or whether that route is now closed. No dollar figure for the theft has come from either company. Josh Lee, a Keplr co-founder, gave an early estimate in his initial findings: about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited. GoPlus, a Web3 security company, said in a security alert that at least about $1 million had been stolen. It did not explain how it reached that figure. The rescued money went into what the login provider calls secure recovery wallets, on 11 blockchains in the Cosmos family and eight Ethereum-style chains. Bitquery, a blockchain data firm, counted at least $6.01 million moving from more than 44,000 wallets into the recovery wallets by late last week. The firm first reported the transfers as theft. It has since issued a corrected analysis that treats them as the rescue, though it says it cannot check who controls the recovery wallets. The first of these transfers came 21 minutes before the login provider's first public notice, the firm's data shows. Most of the wallets, 86%, were emptied after the wallet maker warned users. The moved funds are safe, the login provider said in its recovery thread, and it is working with the wallet maker to return them to users. It has not said how or when. The login provider said the issue affects its services used by some other companies, but Keplr is the only one it has named. It paused its embedded wallet service, which other apps use to build wallets for their users. Its status page still shows its login service as down today. Consensys, the company behind the MetaMask wallet, bought the login provider in June 2025. Its acquisition announcement said the deal would let MetaMask users create and recover wallets with social logins. The provider said its initial investigation found "no evidence that MetaMask users are impacted." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Blockchain, cryptocurrency, data breach, Vulnerability, Web Security China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls AI-Generated Fake Login Pages Are Making Account Takeovers Easier See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk