CryptoSlate
Keplr reported unauthorized transactions on Nov. 7 on some accounts created with Google or Apple login, and paused those sign-in methods the same day. Web3Auth, the login provider behind the embedded wallets, confirmed a security issue in its infrastructure and dated its maintenance window to Nov. 6 at 18:30 UTC. Accounts created with recovery phrases or hardware wallets were not affected, while Google- or Apple-login accounts might be.
Why it matters
The incident exposes the dependency baked into social-login wallets: when the login provider stops working, users lose access, and when the provider is breached, users may lose control of the key itself. Keplr's documentation says Google-login accounts receive a hexadecimal private key generated through Web3Auth instead of a recovery phrase, stored encrypted on the device. A saved key offers a documented import route independent of Google sign-in, but importing the same key into another app changes access software without changing the secret. It does not establish that nobody else possesses it.
Market impact
Keplr advised potentially affected users against sending new funds and urged them to move remaining liquid assets to a recovery-phrase or hardware-wallet account. Web3Auth and partners began whitehat recovery on vulnerable wallets using the attacker's original path, so some reduced or empty balances could reflect mitigation rather than theft. As of Nov. 8 at 13:08 UTC, Web3Auth's status page still promised an update when service was restored. MetaMask said an initial investigation found no evidence its users were impacted. Restoring login service would settle availability, but not account-level impact or asset recovery.
Frequently asked questions
-
Are all Keplr wallets affected by the Web3Auth incident?
No. Keplr said accounts created with recovery phrases or hardware wallets were not affected, while accounts created with Google or Apple login might be.
-
What should Keplr users do if their social-login account may be compromised?
Keplr advised against sending new funds to affected accounts and said remaining liquid assets should be moved to a recovery-phrase or hardware-wallet account.
-
Does importing my private key into another wallet app make it safe again?
No. Importing changes the software used to access the account but does not change the secret itself or establish that nobody else possesses a copy.
-
Why do some Keplr balances look reduced or empty after the incident?
Web3Auth and partners began whitehat recovery on vulnerable wallets using the attacker's path, so reduced or empty balances could reflect mitigation efforts rather than theft. Staked and locked assets complicate the work.
-
Is the Web3Auth login service back online yet?
As of Nov. 8 at 13:08 UTC, Web3Auth's status page still promised an update when service was restored, and its displayed maintenance window, which ended Nov. 7, did not confirm restoration.
TheBlock
WuBlockchain
Crypto Capital Venture
WatcherGuru
CoinDesk
Crypto News