Attackers exploited a flaw in Web3Auth’s infrastructure to drain Keplr wallets created through Google or Apple sign-in, prompting Web3Auth to halt social login and sweep at-risk funds into recovery wallets. Public notice of the problem came on Monday, November 9.
Keplr Calls Web3Auth Issue a Private Key Breach
Web3Auth reported a security issue in infrastructure that supports embedded wallets. Keplr described the problem as a private key breach for users who signed in with Google or Apple. Keplr is the only named victim, but the issue touches Web3Auth services used by other applications, so the exposure may extend beyond a single wallet.
Keplr co-founder Josh Lee estimated that about 20% of Google and Apple login accounts were affected, with only a fraction actually exploited.
Loss Estimates Range From $1 Million to Over $6 Million
Figures for the damage differ by source. GoPlus reports at least $1 million confirmed stolen. Bitquery tracked about $6.01 million moved into recovery wallets across several blockchains. The two numbers measure different things: one counts confirmed theft, the other counts funds that were relocated, including funds Web3Auth said it moved to safety.
Web3Auth Moves Funds to Recovery Wallets Within 21 Minutes
Web3Auth said it moved at-risk funds to recovery wallets within 21 minutes of the first public notice. It also halted social login while the investigation continues. The measure stopped new sign-ins through the affected path and limited further drains.
The sweep reflects a protective step that depends on the provider having the technical means to relocate funds from affected wallets, and the available reporting does not explain how that was done. Nor does it explain how attackers obtained access to private keys through Web3Auth’s systems.
Why Embedded Social-Login Wallets Concentrate Risk in One Provider
Embedded wallets let users sign in with an existing Google or Apple account instead of managing a seed phrase. The design makes onboarding easier, but it places key-handling infrastructure with a provider such as Web3Auth. When that infrastructure has a flaw, every application built on it can be exposed at once, which explains why Keplr’s statement and Web3Auth’s notice both treat the issue as a provider-level problem.
Open Questions Over Scope, Other Apps and Final Losses
Several facts remain unsettled. The reporting does not name other applications that rely on the affected Web3Auth services, and it does not say how many accounts were drained. Lee’s 20% estimate describes accounts that could have been affected, not accounts that lost funds.
The gap between the $1 million and $6.01 million figures will likely narrow as investigators separate stolen assets from relocated ones. For users, the practical outcome so far is a paused login method and a set of funds held in recovery wallets.
Social login for the affected wallets stays paused during the investigation. Keplr and Web3Auth have not published a restoration date, and neither has said whether the recovered funds will be returned to account holders directly.
Funds Protected Versus Funds Stolen
The gap between the two published loss figures is the most important unresolved detail. GoPlus’s figure of at least $1 million describes funds confirmed stolen. Bitquery’s $6.01 million describes funds that ended up in recovery wallets across several chains. If the recovery-wallet figure includes assets that Web3Auth moved before attackers could take them, then roughly $6 million was secured while at least $1 million left victims’ control. Neither company has published a full accounting, and Keplr’s co-founder has stated only that a fraction of the roughly 20% of affected accounts were exploited.
Web3Auth’s response centered on speed. The 21 minutes between first public notice and the move of at-risk funds to recovery wallets is the only response metric the company has given. Its decision to halt social login also affects applications beyond Keplr that use the same services, though the reporting names none of them, and Keplr remains the only publicly identified victim.
