Community Trust ScoreVerified
Web3Auth paused wallet login services on Nov. 6 at 18:30 UTC following a security incident, a move that has left some Keplr users unable to access accounts created with Google or Apple login. Keplr reported unauthorized transactions on these social-login accounts and stated that the private keys for some affected users may have been compromised.
The incident began when Web3Auth identified a security issue in its infrastructure affecting certain embedded wallets used by Keplr. On Nov. 7, the Keplr team reported the unauthorized transactions and paused the affected login methods. Web3Auth’s status page, updated at 13:08 UTC on Nov. 8, indicated that the service had not yet been restored, despite a displayed maintenance window that ended on Nov. 7.
Access dependencies and key exposure
Keplr’s security documentation, updated in September 2025, explains that accounts created with Google login receive a hexadecimal private key generated through Web3Auth rather than a standard recovery phrase. This key is encrypted and stored locally on the user’s device. The documentation also describes a “View Private Key” option, though exceptions exist for some legacy accounts.
While Keplr’s mobile import guide documents connecting with Google and importing with a recovery phrase or private key, the company noted that a previously saved, usable private key offers a documented route independent of Google login. However, Keplr clarified that this documented route does not establish that an incident-affected key remains safe. Importing the same key into another interface changes the access software but does not alter the secret authorizing the account or prove that no other party possesses it.
MetaMask Builder announced on Nov. 7 that an initial investigation found no evidence that MetaMask users were impacted by the incident. Keplr specified that accounts created with recovery phrases or hardware wallets were not affected, while those using Google or Apple login might be.
Asset protection and recovery efforts
Keplr advised users with potentially affected accounts against sending new funds. The company stated that remaining liquid assets should be moved to a recovery-phrase or hardware-wallet account. This guidance distinguishes between moving assets to a different account and loading the same key into another application, noting that the latter does not resolve confidentiality concerns.
Web3Auth stated that it and its partners had begun whitehat recovery activities targeting vulnerable Keplr wallets not yet impacted. These efforts use the original attacker’s path to secure assets. Keplr noted that some reduced or empty balances could reflect these mitigation efforts. The company added that staked and locked assets made the recovery work more complex, meaning an unfamiliar transfer or diminished balance alone cannot establish which specific activity occurred.
Restoring the login service would address the availability question for users, but it would not settle the unresolved issues regarding account-level impact or the status of asset recovery for those whose keys may have been exposed.
Frequently Asked Questions
Which Keplr accounts are affected by the Web3Auth incident?
Accounts created with Google or Apple login may be affected by the private-key breach. Accounts created with recovery phrases or hardware wallets were not affected.
What should Keplr users do if their account is affected?
Keplr advised users to avoid sending new funds and to move remaining liquid assets to a recovery-phrase or hardware-wallet account.
