Web3Auth Halts Embedded Wallet Service After $6 Million Outflow Incident Hits Keplr

Web3Auth paused its embedded wallet service on November 6, 2026, at approximately 21:13 UTC after identifying a critical security issue, and on-chain tracking now links the breach to roughly $6 million in outflows across the Cosmos ecosystem. The provider, now folded into MetaMask under Consensys, said it shut down the service to investigate possible impact, according to its own incident disclosure.

The fallout landed hardest on Keplr Wallet, a widely used wallet in the Cosmos ecosystem. Keplr had used Web3Auth to power social logins, letting users sign in with Google and Apple accounts instead of managing a seed phrase. Keplr reported unauthorized transactions beginning around November 6, the same day Web3Auth flagged the issue. After tracing the problem back to Web3Auth, Keplr disabled Google and Apple login options on November 7 to limit further risk.

How large is the exposure?

On-chain data linked to the breach shows approximately $6 million moving from more than 44,000 Cosmos addresses and about 7,600 Injective addresses. Web3Auth has contested that figure, so the $6 million should be read as an estimate drawn from on-chain flows rather than a confirmed tally of stolen funds.

Not every Keplr user sat in the blast radius. Roughly 20% of Keplr users who relied on social logins could have been exposed, according to figures tied to the incident. Trust Wallet and standard MetaMask accounts were unaffected, and Keplr accounts that never used social login also remained untouched.

What is Web3Auth doing about it?

The company has started recovery measures, including white-hat transfers that move assets out of vulnerable wallets into verified addresses before an attacker can reach them. How much exposed value those transfers manage to secure remains an open question.

Web3Auth says it has found no evidence that MetaMask users were affected. That reassurance carries weight for MetaMask and Consensys, given Web3Auth now sits inside the MetaMask product stack under Consensys ownership.

Why do social-login wallets concentrate risk?

Embedded wallets with social login exist to solve crypto's oldest usability problem: the seed phrase. Users sign in the way they would with any conventional app, while a third party handles much of the key management behind the scenes.

Many of these setups rely on multi-party computation, or MPC. MPC splits control of a private key across multiple parties, so no single piece alone can move funds. On paper, that spreads risk. In practice, the architecture also adds a dependency: if the provider handling part of the key-management process has a flaw, every application built on it may inherit that flaw.

The Keplr case demonstrates the concentration risk in concrete terms. One integration with a single embedded wallet provider rippled across two ecosystems at once, reaching both Cosmos and Injective users. Keplr's decision to disable social logins functioned as the emergency brake.

For builders, the incident raises a hard structural question. When many wallets plug into the same embedded wallet provider, a single flaw can cascade across multiple chains simultaneously, rather than remaining contained within one application.

What happens next?

Three unresolved items will define the incident's final accounting. The first is whether Web3Auth's dispute of the $6 million figure produces a materially different number. The second is how much of the exposed value the white-hat transfers secure. The third is when, and under what conditions, Web3Auth restores its embedded wallet service and Keplr re-enables social logins — a decision that will signal whether MPC-based key management can retain user trust after a supply-chain-level failure.