Attacker steals crypto from Keplr wallets created with Google or Apple login through a flaw at login provider Web3Auth; Web3Auth swept other at-risk wallets to recovery wallets

An attacker used a security flaw in Web3Auth's infrastructure to get the private keys of some Keplr wallets created with Google or Apple sign-in and drain them. Keplr and Web3Auth both confirmed it late last week (around 6-7 Nov 2026). When the attacker first used the flaw is unknown. Keplr's co-founder estimates about 20% of Google/Apple-login accounts were affected and only some were drained. GoPlus puts the theft at about $1M or more. Web3Auth then used the same route to move funds from 44,000+ other at-risk wallets (at least $6.01M, per Bitquery) into its own recovery wallets on 11 Cosmos chains and 8 EVM chains, so an empty wallet may have been rescued, not stolen. Web3Auth says its services used by other, unnamed companies are affected too; it has paused its embedded wallet service and its login service is down. Keplr has paused Google/Apple sign-in. Wallets made with a recovery phrase or a hardware wallet are not affected, and Web3Auth found no evidence that MetaMask users are affected. How the flaw worked and whether it is closed: unknown.