Keplr Wallet (Web3Auth)

What happened

In November 2026, attackers conducted unauthorized transactions from Keplr wallets created using Google or Apple social login, affecting accounts that relied on Web3Auth's third-party authentication and key-management infrastructure. Keplr and Web3Auth launched a joint investigation and suspended affected login services. Wallets created using recovery phrases or hardware wallets were not believed to be affected. The exact vulnerability, total funds stolen, and affected blockchain networks remained undisclosed

Details

Date

Nov 6, 2026

Kind

Hack or exploit

Method

Supply Chain Attack

How in

Keys, accounts and infrastructure

Target

People and personal wallets

Chains

not stated

What would have stopped it all controls for this way in

• What users load is locked down: build pipeline, dependencies, CDN, DNS and third-party scripts.
  Check: Who can change the code served to users, listed; dependencies pinned; DNS registrar locked; third-party scripts reviewed.
• Freeze contacts are arranged before they are needed: stablecoin issuers, the large exchanges, SEAL 911.
  Check: A contact sheet with named people, confirmed this quarter; one drill sending a freeze request.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗no figure

Related incidents