---
id: "CMP-202611-mdnus3"
page: "https://infrastack.ai/live/CMP-202611-mdnus3"
kind: "campaign"
aliases: []
title: "Attacker steals crypto from Keplr wallets created with Google or Apple login through a flaw at login provider Web3Auth; Web3Auth swept other at-risk wallets to recovery wallets"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Keplr", "fixed": [], "vendor": "Keplr"}, {"name": "Web3Auth", "fixed": [], "vendor": "Consensys"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T11:07:34+00:00"
updated_at: "2026-11-09T11:08:58+00:00"
sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html", "first_seen_at": "2026-11-09T11:07:34+00:00", "cites": ["https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html"]}]
exploit_sources: []
---

# Attacker steals crypto from Keplr wallets created with Google or Apple login through a flaw at login provider Web3Auth; Web3Auth swept other at-risk wallets to recovery wallets

Link for people: https://infrastack.ai/live/CMP-202611-mdnus3 (this .md is for agents)

An attacker used a security flaw in Web3Auth's infrastructure to get the private keys of some Keplr wallets created with Google or Apple sign-in and drain them. Keplr and Web3Auth both confirmed it late last week (around 6-7 Nov 2026). When the attacker first used the flaw is unknown. Keplr's co-founder estimates about 20% of Google/Apple-login accounts were affected and only some were drained. GoPlus puts the theft at about $1M or more. Web3Auth then used the same route to move funds from 44,000+ other at-risk wallets (at least $6.01M, per Bitquery) into its own recovery wallets on 11 Cosmos chains and 8 EVM chains, so an empty wallet may have been rescued, not stolen. Web3Auth says its services used by other, unnamed companies are affected too; it has paused its embedded wallet service and its login service is down. Keplr has paused Google/Apple sign-in. Wallets made with a recovery phrase or a hardware wallet are not affected, and Web3Auth found no evidence that MetaMask users are affected. How the flaw worked and whether it is closed: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Keplr affected range not listed fixed no fixed version listed
- :Web3Auth affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says an attacker used a security flaw in Web3Auth's infrastructure to obtain private keys of Google/Apple-login Keplr wallets, but it states that how the flaw worked and whether it is closed is unknown, so the entry route is not given.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach

## How to check

You hold a Keplr wallet (or a wallet in another app built on Web3Auth / MetaMask Embedded Wallets) that was created with Google or Apple login rather than a recovery phrase or hardware wallet. Check outgoing transfers against Web3Auth's published recovery address list: transfers there are the rescue, other unexpected outflows may be theft (Web3Auth warns that an unknown address is not necessarily the attacker). Apps that use the Web3Auth embedded wallet SDK for their own users are exposed too. Treat DMs or links offering 'recovery' as scams.

## Fix

Do not send new funds to Google/Apple-login Keplr accounts, and do not re-import or recreate them anywhere. Move any funds that are not staked or locked to a wallet that uses a recovery phrase or a hardware wallet. Trust updates only from the official Keplr and Web3Auth accounts. If you build on the Web3Auth embedded wallet service, check your users' wallets and follow Web3Auth's incident updates.

## Timeline

- 2026-11-09T11:07:34+00:00 analyst https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

## Documents

- [describes] @TheHackersNews: ⚠️ Hackers exploited a Web3Auth flaw to steal crypto from Keplr wallets using Go https://x.com/TheHackersNews/status/2119746451379191823
- [describes] Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_