A critical security flaw within the Web3Auth infrastructure has been actively exploited in the wild, leading to the theft of cryptocurrency from Keplr wallets configured via social login options. Attackers specifically targeted users who established their accounts using Google or Apple sign-in methods, prompting an immediate operational response from the affected wallet and authentication providers. The incident came to light following widespread investigative reporting on 9 November 2026, detailing how malicious actors leveraged the underlying infrastructure weakness to compromise user assets.
Web3Auth provides embedded wallet and authentication services that allow decentralized application users to log in easily using traditional credentials like Apple and Google accounts. When vulnerabilities affect this kind of multi-party computation and key management infrastructure, the impact can cascade across multiple client applications that integrate the service. In response to the active exploitation, Keplr immediately paused its Google and Apple sign-in options while the scope of the infrastructure compromise was investigated.
The exploitation directly impacted Keplr crypto wallets created using the social login integrations. To mitigate further losses, Web3Auth took the unprecedented step of proactively draining at-risk user accounts to secure recovery wallets. This mass protective measure spanned across 11 Cosmos family blockchains and 8 Ethereum-style chains, safeguarding funds from being captured by the unauthorized attackers who initially breached the infrastructure.
Security firms and blockchain data analysts quickly mobilized to estimate the financial fallout and track fund movements following the disclosure. According to findings reported by Web3 security firm GoPlus, at least $1 million was successfully stolen by the attackers before mitigations took effect. Meanwhile, separate blockchain data provided by Bitquery indicated that at least $6.01 million was moved from over 44,000 vulnerable wallets into designated recovery wallets during the protective draining operation.
Consensys previously acquired Web3Auth in June 2025, and initial investigations into the infrastructure incident confirmed that MetaMask users were not impacted by the flaw. However, the scale of the exploit and the necessity for a provider-initiated mass drainage event highlight the inherent risks associated with third-party authentication dependencies in decentralized finance ecosystems. Users across multiple blockchain networks faced significant disruption as Web3Auth paused its embedded wallet and login services entirely during the ongoing security review.
Security teams and affected users are advised to avoid sending new funds to compromised accounts, and should never re-import or recreate vulnerable accounts anywhere. Individuals should move any non-staked or non-locked funds to accounts utilizing a secure recovery phrase or a hardware wallet, while trusting updates solely from official channels of the wallet maker and login provider while ignoring direct messages or links offering recovery.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
