-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0323 ============================================================ Advisory-ID: 0xCERT-2026-0323 Severity: High Published: 2026-11-06T21:13:33.000Z Updated: 2026-11-07T20:42:26.565Z Chains: Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0323 Title: Keplr Google/Apple-login wallets drained after Web3Auth security incident; social login paused Summary - ------- Unauthorized transactions hit some Keplr accounts created with Google or Apple login via Web3Auth. Keplr and Web3Auth paused social login; affected users should not send new funds to those accounts. Recovery-phrase and hardware wallets are not affected. Details - ------- Summary Keplr reports unauthorized transactions from some Keplr accounts created with Google or Apple social login, which rely on Web3Auth's login and key-management infrastructure. Web3Auth acknowledged a security issue affecting its services used by some third parties, paused its embedded wallet service, and placed its Login Service into maintenance mode. Keplr has paused Google/Apple login. Keplr co-founder Josh Lee states the incident originated at Web3Auth, not in Keplr's code. Affected - - Keplr accounts created with Google or Apple login (Web3Auth-backed). Keplr's early estimate is that about 20% of these accounts are affected, and that only a fraction of those have actually been exploited. - - Not affected per Keplr's initial assessment: Keplr wallets created with a recovery phrase or a hardware wallet. - - Web3Auth states it has found no evidence that MetaMask users are impacted. - - No fix available at time of publication; the affected login services are paused. Impact Funds were moved out of affected social-login accounts without authorization; exploitation in the wild is confirmed by Keplr. Neither Keplr nor Web3Auth has published a root cause, total loss figure, list of affected networks, or attacker addresses at the time of publication. Media reports that the affected assets are in the Cosmos ecosystem; loss estimates circulating in the press are unverified by Keplr or Web3Auth. Media also report that Web3Auth and partners made protective recovery transfers from at-risk accounts, so unfamiliar outgoing transfers are not necessarily attacker activity; no indicators are listed in this advisory for that reason. Recommended actions - - If you created a Keplr account with Google or Apple login: do not send new funds to it and do not re-import or recreate it anywhere (Keplr guidance). - - Once guidance is published, move remaining assets to a wallet secured by a recovery phrase or a hardware wallet. - - Trust updates only from Keplr's official X account (@keplrwallet); ignore DMs or links offering "recovery". - - Projects integrating Web3Auth embedded wallets or social login should follow Web3Auth's status page and official channels and review exposure. Source & attribution This 0xCERT advisory summarises disclosures by Keplr (https://x.com/keplrwallet/status/2118926087615045807), Keplr co-founder Josh Lee (https://x.com/dogemos/status/2118984142151196677), and Web3Auth (https://x.com/Web3Auth/status/2118814067359969745, https://status.web3auth.io/events/maintenance/461); the incident was also listed by DeFiLlama. Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/keplrwallet/status/2118926087615045807 - - https://x.com/Web3Auth/status/2118814067359969745 - - https://x.com/dogemos/status/2118984142151196677 - - https://status.web3auth.io/events/maintenance/461 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrwE4MJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcx0Bgi+GxWLaDWw6P/pvCujDyEJWySrV4NRlR4 w019PhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAD3vQD9EDNaK6aZ3dOGBf/G O/Vs+eqjAoh7VKgMMORXfKn3/ZYA/Av32d4e4CqHZzCuAuaheloEO92nN3b6 Zf0Y/2+VUVcJ =0XYP -----END PGP SIGNATURE-----