Attacker steals from Keplr wallets through Web3Auth flaw
Keplr paused Google and Apple sign-in while Web3Auth’s login service remains down; Web3Auth says it moved other at-risk funds to recovery wallets.
Loading… Բեռնվում է…
Keplr paused Google and Apple sign-in while Web3Auth’s login service remains down; Web3Auth says it moved other at-risk funds to recovery wallets.
Web3Auth said it moved funds from at-risk Keplr wallets into recovery wallets after an attacker exploited a flaw in its infrastructure to steal from some users. Both companies acknowledged the exploitation, which affected wallets created with Google or Apple sign-in.
Keplr uses Web3Auth to provide those sign-in options. Keplr paused them during its investigation, and Web3Auth’s status page still showed its login service down on 9 November 2026, The Hacker News said.
Web3Auth said it used the attacker’s route, with Keplr’s help, to move other exposed funds to safety. An emptied wallet therefore does not necessarily mean its funds were stolen.
Keplr described the incident as a private-key breach for some Google and Apple sign-in users. A private key is the secret code that authorizes wallet payments; someone holding it can move the funds. Keplr said wallets created with a recovery phrase—a backup list of words—or a hardware wallet were not affected.
Keplr co-founder Josh Lee’s preliminary estimate put affected accounts at about 20% of Google and Apple login accounts. Only a fraction of those appeared to have been exploited. Neither company has disclosed how the flaw worked, when exploitation began or whether the attack route has been closed.
Security company GoPlus estimated that at least about $1 million had been stolen, but did not explain its calculation. Neither Web3Auth nor Keplr has provided a dollar total for the theft.
Blockchain data firm Bitquery counted at least $6.01 million transferred from more than 44,000 wallets into recovery wallets by late the preceding week. It initially described those transfers as theft, then corrected its analysis to treat them as recovery transfers. Bitquery said it could not verify who controls the recovery wallets.
Web3Auth published a recovery-address list that it said helps users distinguish its transfers from potentially malicious ones. It warned users not to assume that an unfamiliar destination address belongs to the attacker.
Keplr advised users of Google and Apple login accounts to take these steps:
Keplr also advised users to trust updates only from its and Web3Auth’s official accounts and ignore direct messages or links offering recovery.
Assets that are staked—committed to supporting a blockchain’s operation—or otherwise locked were taking longer to secure. Keplr was also working with Web3Auth on a way for users to check whether their account was affected.
Web3Auth said the transferred funds were safe and it was working with Keplr to return them to users. It has not announced how the return will work or a timetable.
The Transportation Department says the flights carried about 24,000 passengers and saved more than 10 minutes each on average. The FAA plans further testing before expanding the system.
3 min
Acronis says the operation collected data or accessed systems at about 10 organizations in Taiwan, Mexico and Thailand, out of hundreds targeted across at least 11 countries.
4 min
The exemption for heat pumps, solar panels and batteries is due to end on 1 April. Industry groups warn that the deadline could bring a rush for installations followed by a downturn.
2 min