Web3Auth pauses embedded wallet service after security flaw; Keplr cuts social logins
In brief
- Web3Auth paused its embedded wallet service on November 6 at about 21:13 UTC.
- Web3Auth said it has no evidence MetaMask users were affected.
- Keplr reported unauthorized transactions and disabled Google and Apple logins on November 7.
- Unconfirmed on-chain tracking data points to about $6 million in outflows; Web3Auth disputes that total.
- Trust Wallet, standard MetaMask accounts and Keplr accounts without social login weren't affected.
What Web3Auth and Keplr said
Web3Auth said it shut the service down to investigate the possible impact of the issue. The company also said there's no evidence MetaMask users were affected.
Keplr's side of it is messier. The wallet used Web3Auth to power social logins (letting users sign in with Google and Apple accounts instead of managing a seed phrase), and it reported unauthorized transactions beginning around November 6, the same date Web3Auth flagged its issue. After tracing the problem back to Web3Auth, Keplr disabled its Google and Apple login options on November 7.
Not everyone was exposed. Keplr accounts that didn't use social login weren't affected, and Crypto Briefing reported that Trust Wallet and standard MetaMask accounts were also found to be unaffected.
The disputed $6 million figure
The on-chain numbers are where it gets murky. Blockchain tracking data linked to the breach (Crypto Briefing didn't name who produced it) shows around $6 million in outflows from more than 44,000 Cosmos addresses and about 7,600 Injective addresses. That's an unconfirmed estimate.
Web3Auth has contested the total.
The company has started recovery measures in the meantime. Those include white-hat transfers, which move assets out of vulnerable wallets and into verified addresses.
What's still open
Crypto Briefing noted that many embedded wallet setups rely on multi-party computation (MPC), which splits control of a private key across multiple parties so that no single piece is enough to move funds on its own. Crypto Briefing's report didn't describe how the flaw worked.
So when do things come back online? As of publication, that's still an open question. Crypto Briefing reported there's no clear timeline for when, or under what conditions, Web3Auth will restore its embedded wallet service and Keplr will turn social logins back on.
Frequently asked questions
Were MetaMask users affected by the Web3Auth security issue?
Web3Auth said there is no evidence MetaMask users were affected. Crypto Briefing also reported that standard MetaMask accounts and Trust Wallet were found to be unaffected.
Which Keplr users were affected by the Web3Auth incident?
Keplr reported unauthorized transactions tied to accounts using social login, which Web3Auth powered through Google and Apple sign-ins. Keplr accounts that didn't use social login were not affected, and Keplr disabled the Google and Apple login options on November 7.
How much was lost in the Web3Auth and Keplr incident?
Unnamed blockchain tracking data linked to the breach shows around $6 million in outflows from more than 44,000 Cosmos addresses and about 7,600 Injective addresses. That figure is unconfirmed, and Web3Auth has contested the total.
