Consensys' Web3Auth pauses embedded wallets after flaw exposes Keplr social-login keys
Web3Auth, now sold as MetaMask Embedded Wallets, says it found no evidence MetaMask users are affected. It has moved funds from vulnerable Keplr Google and Apple login wallets to 12 published recovery addresses.
· Announced · Verified 2026-11-09 via official announcement
Announced Nov 8, 2026: Consensys' Web3Auth pauses embedded wallets after flaw exposes Keplr social-login keys. Affects: Keplr users who created wallets with Google or Apple login. Source: x.com, verified Nov 9, 2026. If this rules MetaMask out, our top-listed alternative is Backpack (0% round trip).
Official site: backpack.app
Web3Auth, the Consensys-owned wallet infrastructure service, said on 6 November 2026 that a security issue affected its services used by some third parties and that it had temporarily paused its embedded wallet service. It has since said the issue was in Web3Auth infrastructure and affected certain embedded wallets used by Keplr, where accounts created with Google or Apple login may be exposed.
Keplr said wallets created with a recovery phrase or a hardware wallet are not affected, paused Google and Apple login, and told affected users not to send new funds to those accounts. Keplr co-founder Josh Lee estimated about 20% of Keplr's Google and Apple login accounts were affected, according to The Block.
Web3Auth said it began whitehat recovery of vulnerable wallets the attacker had not yet reached and on 8 November published recovery addresses on Cosmos Hub, Osmosis, Celestia, Injective, dYdX and other Cosmos chains plus one EVM address. Those 12 addresses held about $5.6 million, per onchain data reviewed by The Block. Bitquery had estimated about $6 million taken from more than 44,000 Keplr wallets, but every address it tied to the thief is on Web3Auth's recovery list, so the amount actually stolen is not known.
Consensys acquired Web3Auth in 2025 and now markets it to developers as MetaMask Embedded Wallets. Web3Auth said its initial investigation found no evidence that MetaMask users are impacted. Neither Web3Auth nor Keplr has published a root cause, the number of wallets drained by the attacker, or a timetable for returning recovered funds; Web3Auth says it is working with Keplr on a recovery path.
Web3Auth's pause covers its embedded wallet service as a whole, so other apps that build on it may also see social-login wallet creation interrupted. U.Today reports that Trust Wallet says it is unaffected.
“We’re aware of a security issue affecting Web3Auth’s services used by some third parties. We have temporarily paused the embedded wallet service. After an initial investigation, we’ve found no evidence that MetaMask users are impacted.”
— Web3Auth on X, 6 November 2026
Who this affects
Keplr users who created wallets with Google or Apple login, and apps that rely on Web3Auth (MetaMask Embedded Wallets) for social-login wallets. Web3Auth says it found no evidence that MetaMask wallet users are affected.
MetaMask at a glance
MetaMask is a self-custodial wallet developed by Consensys, available as a browser extension and mobile app. It has built-in Swaps and Bridge (a quote aggregator across EVM chains plus Solana, Bitcoin and Tron), limit orders on mobile swaps, Hyperliquid-powered perps, prediction markets, tokenized stocks and the mUSD stablecoin.
Full MetaMask sheet · 1.75% round trip
Official site: metamask.io
More from the newsroom
Sources
Last checked . Fees and terms change often; the venue's own page wins if it disagrees with ours.
- Web3Auth on X - security issue; embedded wallet service paused (2026-11-06) — checked 2026-11-09
- Web3Auth on X - issue in Web3Auth infrastructure affecting certain Keplr embedded wallets; whitehat recovery (2026-11-07) — checked 2026-11-09
- Web3Auth on X - verified Keplr recovery addresses (2026-11-08) — checked 2026-11-09
- Keplr Wallet on X - Google/Apple login accounts may be affected; recovery-phrase and hardware wallets not affected (2026-11-07) — checked 2026-11-09
- The Block - Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets (2026-11-08) — checked 2026-11-09
- MetaMask developer docs - MetaMask Embedded Wallets (formerly Web3Auth) — checked 2026-11-09
- U.Today - Web3Auth Exploit Doesn't Affect Trust Wallet (2026-11-08) — checked 2026-11-09
About DexSheet
DexSheet is an independent fee sheet for on-chain trading. It tracks the fees, custody, backers, incidents and availability of 98 crypto trading venues, with a dated source for every number. Every newsroom entry is checked against the venue's own announcement, docs or terms before it is published. Data: fees.json (CC BY 4.0) · RSS.