Keplr social-login breach shows the limit of re-importing an exposed private key
In brief
- Keplr reported unauthorized transactions on some Google- and Apple-login accounts on Nov. 7.
- Web3Auth said an infrastructure security issue affected certain embedded wallets used by Keplr.
- Recovery-phrase and hardware-wallet accounts were not affected, Keplr said.
- Re-importing the same private key doesn't prove nobody else holds it, CryptoSlate argues.
- Keplr advised moving remaining liquid assets to recovery-phrase or hardware-wallet accounts.
What Keplr and Web3Auth said
In a later Nov. 7 update, Keplr described a private-key breach affecting some social-login users and said it was assisting Web3Auth's effort to protect assets. Accounts created with recovery phrases or hardware wallets weren't affected, Keplr said. Google- or Apple-login accounts might be.
Web3Auth's Login Service notice dated the maintenance to Nov. 6 at 18:30 UTC and attributed it to a security incident. The displayed maintenance window ended Nov. 7 (the status endpoint didn't confirm restoration, though), and at 13:08 UTC on Nov. 8 Web3Auth's status page still promised an update when service was restored, according to CryptoSlate.
MetaMask's Nov. 7 Builder announcement said an initial investigation found no evidence MetaMask users were impacted.
Why a backup isn't the same as a fix
Keplr's security documentation (updated in September 2025) says Google-login accounts receive a hexadecimal private key generated through Web3Auth instead of a recovery phrase. It's encrypted and stored locally on the user's device. The docs describe a View Private Key option, with exceptions for some legacy accounts, and Keplr's mobile import guide tells Google-login users to save that key securely.
So there's a documented way to log in without Google. CryptoSlate's Liam Wright argues it doesn't answer the harder question: importing the same private key into another interface doesn't change the secret authorizing the account, and it can't establish that nobody else possesses it.
"The documented route is not a tested workaround for this incident."
That's the catch.
What Keplr told users to do
For potentially affected accounts, Keplr advised against sending new funds and said remaining liquid assets should be moved to a recovery-phrase or hardware-wallet account. CryptoSlate stated that, for those accounts, Keplr's incident guidance takes precedence over routine re-import instructions.
The distinction matters for anyone who signed up through social login and assumed the private-key backup was their safety net. It's an access tool. Keplr's own guidance for this incident points somewhere else (a recovery-phrase or hardware-wallet account).
Frequently asked questions
Which Keplr accounts were affected by the Nov. 7 incident?
Keplr said accounts created with recovery phrases or hardware wallets were not affected, while accounts created with Google or Apple login might be. It described a private-key breach affecting some social-login users.
Does re-importing a Keplr Google-login private key make the account safe?
According to CryptoSlate's analysis, no. Importing the same private key into another interface doesn't change the secret authorizing the account or establish that nobody else possesses it, and the documented import route was not a tested workaround for this incident.
What did Keplr advise potentially affected users to do?
Keplr advised potentially affected users against sending new funds and said remaining liquid assets should be moved to a recovery-phrase or hardware-wallet account. CryptoSlate stated that this incident guidance takes precedence over routine re-import instructions.
Were MetaMask users affected by the Web3Auth security issue?
A Nov. 7 MetaMask Builder announcement said an initial investigation found no evidence MetaMask users were impacted.
