Web3Auth Disputes $6M Keplr Wallet Theft
Web3Auth says a reported $6.01 million drain from Keplr social-login wallets is overstated, after confirming a vulnerability in its services.
Updated on Nov. 8, 2026 in Cybersecurity
Live Poll
Would you trust a company to hold your crypto keys after a breach like this?
Funds began draining from Keplr wallets tied to social logins on November 6 and 7, 2026, and Web3Auth paused its embedded wallet service on November 6. Web3Auth has disputed a reported $6.01 million theft, while confirming the underlying vulnerability.
Why it matters
The incident shows how a flaw in a third-party authentication service can expose wallets built on social logins. Users of such wallets across the Cosmos and EVM ecosystems face direct risk to their holdings.
Bitquery tracked 44,041 affected wallets in the Cosmos ecosystem and 7,603 on Injective, with the vulnerability affecting roughly 20% of wallets created through Google and Apple logins. Web3Auth has not confirmed the $6.01 million loss estimate, which was calculated by tallying funds that flowed out during the incident window.
The players
Web3Auth
Web3Auth is a wallet authentication provider whose services underpin social-login wallets, and it confirmed the vulnerability at the center of the incident.
Keplr
Keplr is a widely used wallet for the Cosmos ecosystem, and its social-login wallets were affected by the draining of funds.
The details
Web3Auth confirmed the vulnerability on November 6, 2026, and paused its embedded wallet service that day. Wallets created with recovery phrases or hardware devices showed no signs of compromise, and Keplr advised users to stop depositing new funds into affected accounts.
Timeline
November 6, 2026: Web3Auth confirms vulnerability and pauses embedded wallet service.
November 6-7, 2026: Funds begin draining from Keplr social-login wallets.
November 8, 2026: Web3Auth publishes a list of verified recovery addresses.
Under the Hood
The incident centers on Web3Auth's embedded wallet authentication service, which Keplr and other wallets rely on for social logins. The flaw exposed how a single third-party authentication layer can put many downstream wallets at once.
Users with social-login wallets should avoid depositing new funds into affected accounts and rely only on official Web3Auth and Keplr channels. Wallets created with recovery phrases or hardware devices showed no signs of compromise.
The takeaway
Users of social-login crypto wallets should check whether their account was created through an affected provider and use only official recovery channels. Keeping a backup recovery phrase or hardware device remains the safer option.
Further reading
For more on the security risks behind wallet breaches, see the Cybersecurity section.
Source note: This article includes information reported by Crypto Briefing.
Live Poll
Would you trust a company to hold your crypto keys after a breach like this?
