The Hacker News reports that some Keplr crypto wallets set up with Google or Apple accounts had funds stolen by an attacker who used a security flaw at Web3Auth, the company running that sign-in [1]. According to the report, Web3Auth then used the attacker's own route to empty other at-risk wallets into recovery wallets for safekeeping, so an empty balance may not mean theft; recovery-phrase and hardware wallets are not affected [1][2]. Keplr users who signed up with Google or Apple should stop sending new funds, move unstaked and unlocked assets to a recovery-phrase or hardware wallet account and trust only official updates [1][2].
This event has not been officially confirmed. Content is based on media or third-party reports.
HighActiveMedia reported
Web3Auth infrastructure flaw exposes private keys of Keplr social-login wallets and leads to theft; Web3Auth preemptively moves funds from other at-risk wallets
1 min read
- Disclosed
- Nov 8, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- Exploitation and patch status
- Exploited
- Technology
- Attack vector
- Impact
- Data type
- Vulnerability status
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance, Technology
What to do nowOur advice
Keplr users who signed up with Google or Apple should stop sending new funds, move unstaked and unlocked assets to a recovery-phrase or hardware wallet account and trust only official updates [1]
Timeline
Technical details
Remediation
Vendor guidance
- 1
- 2
References
Media2
- [1]
“Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.”
- [2]Defiprime2026-11-08
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.