unpatched/intel
Latest briefing
MonitorExploitedhighSupply Chain Security

Web3Auth flaw leads to Keplr private key breach and crypto theft

By Harith Dilshan2 min read

TL;DR

Web3Auth and Keplr users face a private key breach due to a security flaw in Web3Auth infrastructure. Users who signed into Keplr via Google or Apple accounts are at risk. Move all liquid funds to a hardware wallet or recovery phrase immediately.

What happened

A security flaw in Web3sAuth infrastructure led to a private key breach for Keplr users who utilized Google or Apple social logins. This breach allows an attacker to move funds from those wallets.

To prevent theft, Web3Auth worked with Keplr to move funds from at-risk wallets into secure recovery wallets across 11 Cosmos family chains and eight Ethereum-style chains. Bitquery reported that over $6.01 million moved from more than 44,000 wallets into these recovery accounts. Keplr has paused Google and Apple sign-in functionality while the investigation continues. Keplr co-founder Josh Lee estimated that approximately 20% of Google and Apple login accounts were affected, though only a fraction of those were exploited.

Why it matters

A private key breach is a total compromise; anyone with the key can approve payments and drain the wallet. Because the flaw exists in the social login provider's infrastructure, the impact extends to any other company using Web3Auth's embedded wallet service, though Keplr is the only one currently named. While Web3Auth has moved many funds to recovery wallets, users must wait for a method to retrieve them.

Who is affected

  • Keplr users who created wallets using Google or Apple social logins.
  • Users of the Web3Auth embedded wallet service.

Note: Consensys stated there is no evidence that MetaMask users are impacted.

What to do now

  1. Move all funds that are not currently staked or locked to an account that uses a recovery phrase or a hardware wallet.
  2. Do not send new funds to your current Keplr account.
  3. Do not re-import or recreate the affected account anywhere.
  4. Verify all updates only through official Keplr or Web3Auth communication channels; ignore direct messages or links offering "recovery."

What we don't know yet

  • The specific technical nature of the Web3Auth infrastructure flaw.
  • The exact timing of the initial exploitation.
  • Whether the exploitation route has been closed.
  • The specific method or timeline for returning rescued funds to users.

Sources

  1. thehackernews.comhttps://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

MonitorExploitedhighSupply Chain SecurityNew

Qubole AWS credentials abused to assume customer roles and steal data

Attackers used Qubole's AWS account (805246085872) to assume customer IAM roles and steal data between October 14 and October 26. Impacted organizations should check CloudTrail logs for suspicious AssumeRole requests and rotate all accessed secrets immediately.

2 min
MonitorhighSupply Chain SecurityNew

Truffle Security launches program to revoke 1.4 million exposed API keys

Truffle Security has launched the Secrets Revocation Program to invalidate 1.4 million publicly exposed secrets. API key issuers and developers must rotate credentials found in public repositories, Docker images, or AI tool configurations to prevent unauthorized access.

2 min
MonitorhighSupply Chain SecurityNew

GitHub Enterprise Server Signing Key Rotation Follows Internal Repository Breach

GitHub says a poisoned third-party VS Code extension contributed to a compromise of an employee device and exfiltration of GitHub-internal repositories. As a follow-on containment step, GitHub is rotating the GitHub Enterprise Server signing key and says GHES administrators need to update trusted GPG public keys before future upgrades will verify successfully.

6 min