Web3Auth infrastructure breach exposed private keys for some Keplr Google/Apple-login wallets

Teaser from the source

Web3Auth (Consensys) said on Nov 6 2026 it had paused its embedded-wallet service over a security issue affecting services used by some third parties, with no evidence MetaMask users were impacted. Its status page put the Login Service into maintenance for a security incident from Nov 6 18:30 UTC. On Nov 7 Keplr reported unauthorised transactions on some wallets created with Google or Apple login, paused those social logins, and said recovery-phrase and hardware-wallet accounts are not affected. Later on Nov 7 Web3Auth said it had identified an infrastructure issue affecting certain embedded wallets used by Keplr that led to a private-key breach, and that it and partners had begun whitehat recovery transfers on vulnerable wallets not yet drained, using the same path as the original attacker. Keplr is assisting that recovery; some Google/Apple-login balances may already look reduced or empty because of those mitigation transfers. Neither vendor has published affected counts or loss totals. Users of affected social-login wallets should not send new funds there, should move remaining liquid assets to a recovery-phrase or hardware wallet, and should ignore third-party recovery DMs.

This is the RSS-feed teaser. Read the full article at the original source.