Web3Auth Restores Wallet Access After Infrastructure Flaw

By Tom Whitfield

Web3Auth said it has restored login and wallet access for existing users after disclosing an infrastructure flaw that exposed some Google- and Apple-linked embedded wallets. The company said affected assets remain in secure custody while recovery work continues.

Which services and sign-in methods are available?

Existing users can sign in through Web3Auth’s Plug & Play and Single Factor Auth (SFA) software development kits. Affected services include Torus Wallet and embedded wallets used by third-party applications such as Keplr. The restored access covers those two SDK routes for existing users, not every Web3Auth feature.

The update follows earlier coverage of exposed Keplr social-login keys. Web3Auth’s latest disclosure adds three operational updates: existing-user access is working again, asset-return planning continues, and some registration paths remain restricted. The material does not identify a wallet count, asset value, incident date or list of affected accounts.

Keplr appears in the disclosure in two capacities: as a third-party application using affected embedded wallets and as the subject of earlier reporting on exposed social-login keys. Torus Wallet is listed directly among affected services.

The disclosure does not say every Torus Wallet or Keplr user was affected, so the product names do not constitute a complete user list.

What does Web3Auth say about asset recovery?

Web3Auth said: “assets from affected wallets remain in secure custody.” The company expects to outline how users can retrieve those assets “in the coming days.” Those statements describe custody and a forthcoming recovery process, not completed returns to users.

The source does not state when users will receive assets or whether every affected wallet is covered by the current sign-in restoration. It also does not quantify a loss, identify an unauthorized transaction or report an amount taken. For users, that leaves the financial scope unmeasured even though account access has resumed.

The Google- and Apple-linked description identifies some exposed wallets by their sign-in links. Web3Auth does not describe the flaw as a breach of Google or Apple. The disclosed failure point is Web3Auth’s infrastructure, which exposed some linked wallets and prompted the recovery response.

Which features remain restricted?

Web3Auth’s current service status separates existing-user access from new registrations:

• Existing users: Plug & Play and SFA users can sign in.
• New SFA registrations: Temporarily limited.
• SDK support: Version 9 and earlier are deprecated; developers need version 10 or 11.
• Sapphire: New registrations can be enabled by migrating to the latest SDK.
• Legacy: Registration restoration is planned before Nov. 23, 2026.

For developers, Sapphire provides the near-term migration route, while Legacy remains tied to a dated restoration target. The restriction affects onboarding rather than the reported ability of existing users to sign in. No corresponding return date for affected assets appears in the disclosure.

How should users handle recovery messages?

Web3Auth warned users not to share seed phrases, private keys or login credentials. It also advised users to ignore unsolicited messages offering asset recovery. The company’s warning directs users away from credential requests sent through unexpected channels while its formal recovery guidance remains pending.

The next concrete checkpoint is Web3Auth’s promised recovery guidance “in the coming days.” Sapphire developers can enable new registrations after migration, while Legacy remains scheduled before Nov. 23, 2026.