A Web3Auth infrastructure flaw exposed private keys for Keplr wallets created via Google or Apple login. Between November 6 and 8, 2026, Web3Auth initiated protective transfers to recovery addresses while coordinating with Keplr to return funds. How much attackers actually took remains undisclosed.
A vulnerability in Web3Auth's infrastructure exposed the private keys of certain Keplr wallets created through Google or Apple social login. Between November 6 and 8, 2026, as users began reporting unauthorized transactions, Web3Auth stated it had launched protective transfers toward addresses it controls for recovery purposes. The company said it was working with Keplr to return the funds to affected users.
What Was Moved and Where Are the Funds Now
Web3Auth published a list of 12 addresses it describes as recovery destinations. At the time of The Block's on-chain check on November 8, those addresses held approximately $5.6 million in crypto assets. That figure is a snapshot of observed on-chain balances, not an estimate of losses attributable to any attacker.
A separate analysis by Bitquery had initially attributed roughly $6.01 million transferred from tens of thousands of wallets to two specific addresses. Bitquery later found that both addresses appeared on the list Web3Auth published as recovery destinations. Bitquery notes it cannot verify who controls those addresses and that its count does not include wallets potentially drained by the attacker toward other destinations.
The two figures are not directly interchangeable. The Block recorded approximately $5.6 million across the twelve recovery addresses at the time of its own verification; Bitquery reconstructed roughly $6.01 million across a different phase and scope of transactions. Part of the activity initially interpreted as theft was connected to recovery operations initiated by Web3Auth.
How much the attacker managed to extract before countermeasures began remains unknown. Web3Auth referenced an “original attacker” in communications cited by the press, but the company has not published a total loss figure nor publicly identified addresses attributed to that individual or group.
How Web3Auth Fits into Keplr Login
Keplr allows wallet creation via a recovery phrase and, for certain accounts, through social login with Google or Apple. In the latter case, access management and key generation involve Web3Auth, a provider of embedded wallet infrastructure. The private key authorizes transactions: whoever holds it can sign operations and move the associated assets.
That distinction matters because a blockchain records transactions but doesn't explain on its own who authorized them, or whether a transfer was made by an attacker or a recovery team. Bitquery reports that some transfers toward addresses later listed by Web3Auth had begun before the company's first public statement. The timeline alone does not allow every movement to be attributed to a single party.
Keplr suspended Google and Apple login and urged users with social accounts not to deposit additional funds. The company also distinguished these accounts from those created with a recovery phrase or hardware wallet, which it indicated were not affected. For a deeper look at the difference between software wallets and dedicated hardware devices, SpazioCrypto's comparative hardware wallet guide covers the key trade-offs. The technical cause of the exposure, the definitive number of accounts involved. The complete restitution procedure have not yet been published in available reports.
What Still Needs Clarification
The incident leaves three operational questions open. First: what caused the vulnerability in Web3Auth's infrastructure and how the keys became accessible. Second: the definitive accounting of funds moved by users, potential attackers, and the response teams. Third: restitution itself. Web3Auth said it was working with Keplr on a recovery path, but the available reports at the time of writing do not yet describe a complete timeline or individual claim procedure.
The addresses published as recovery destinations are observable on-chain, but their balance does not equal a completed refund. Until assets are returned to users, they remain in separate addresses and their availability depends on the custody and transfer arrangements adopted by the parties involved.
What This Means for Wallet Users Globally
The incident's communications do not indicate a geographic breakdown of affected accounts, so there's no way to know how many users in any given country are involved. The risk depends entirely on how the wallet was created: Keplr's warning covers accounts set up with Google or Apple login, while accounts configured with a recovery phrase or hardware wallet were indicated as excluded from the incident.
The distinction between key exposure and personal data leaks also surfaced in the recent Keystone breach, where customer addresses were compromised. Anyone using Keplr should consult only updates published on the company's official channels and follow the instructions specific to their account type. Be especially wary of unsolicited messages promising fund recovery or requesting private keys, recovery phrases, or upfront payments: no independent information gathered so far confirms that any external party can accelerate restitution. Targeted phishing campaigns following security incidents are well documented, including after the SafePal data breach and the Trezor breach.
Web3Auth and Keplr: Confirmed vs. Unknown
What has been established and what still needs verification:
- Confirmed: a Web3Auth vulnerability exposed private keys for Keplr wallets created with Google or Apple login; protective transfers toward recovery addresses were initiated.
- Not disclosed: the complete technical cause, the definitive number of affected accounts, and losses attributable to the attacker.
- To monitor: the user restitution plan and a full accounting of recovery transfers.
The Bigger Picture on Social Login Wallets
This episode points to a structural tension in social-login wallets: the simplified user experience can depend on external infrastructure that participates in key management. That's a different risk category from commercial data leaks like those catalogued in SpazioCrypto's dedicated crypto attacks section, but both illustrate how much the services surrounding digital custody actually matter. Convenience at login doesn't eliminate the need to protect the process that allows transactions to be signed.
The emergency response also complicated on-chain data interpretation. Web3Auth stated it used the same technical method as the attacker to secure assets still present in vulnerable wallets. A single anomalous transfer, then, does not by itself prove theft. Verified addresses, a complete chronology, and a full accounting of funds actually returned to users are needed before any firm conclusions can be drawn.
