Web3Auth Breach Drains $6 Million From Over 44,000 Keplr Wallets

Eight Cosmos Networks Hit in Saturday Breach

More than 24 hours after the incident surfaced on Saturday, November 7, the breach at Web3Auth, the wallet authentication infrastructure owned by Consensys, remains under active response, with the company working to recover assets taken from affected users. Investigations and rapid protocol patches have continued throughout, more than a day after the first reports. Web3Auth has confirmed that attackers reached wallets provisioned through its embedded solution inside Keplr, above all accounts opened with a Google or Apple login. Embedded wallet technology lets an application stand up a wallet behind a familiar web login, which lowers the entry barrier but concentrates custody of the underlying private key material with the infrastructure provider rather than the user. That design is precisely what turned a single infrastructure flaw into a mass key-exposure event. On-chain data puts the damage at a minimum of $6 million drained from more than 44,000 wallets, a count that may still move as tracing continues across the affected networks. All of them live on eight networks across the Cosmos ecosystem, with Cosmos Hub, Osmosis, Celestia and Injective among them. Keplr warned users against depositing fresh funds into the compromised wallet addresses, since anything moved into an exposed account would sit in the drain's path. Web3Auth, on its side, suspended the embedded wallet service outright and is working on a recovery of the vulnerable assets. Taking the entire service offline rather than patching individual accounts indicates the provider could not yet bound the exposure. Web3Auth has not yet disclosed how the keys were extracted, how many accounts were provisioned through each login provider, or whether other login flows were exposed. The November 7 compromise and the emergency response that followed could deepen pressure on a crypto market that was already fragile.

Trust Wallet and MetaMask Report No Impact

The reach of the compromise beyond Cosmos was the first question other wallet providers had to answer, and the early answers favored the largest names. MetaMask said it found no evidence of affected users and described the situation as still under control, while Trust Wallet representative Felix confirmed in a public post on X that the company's products were unaffected by the Web3Auth compromise. The impact on other third-party integrations is yet to be confirmed, an open question for every application that depended on the suspended embedded wallet service. For the wallet's own user base, the confirmation arrives alongside a run of separate security notices, including $561,000 in iOS wallet thefts flagged by GoPlus Security, critical PHP vulnerabilities the company said required no user action, and a warning from CZ about a fake Trust Wallet site supporting three major wallets. Users unsure of their next steps after a warning of this kind can review how to recover a compromised crypto wallet. The incident also lands in a year marked by outsized losses. Binance reportedly absorbed a breach involving roughly $6.3 billion on Thursday, October 29, and Bitget's September exploit was estimated at $387.5 million. The Binance figure is a reported estimate rather than a confirmed accounting, and it dwarfs the Web3Auth loss by orders of magnitude. KelpDAO earlier in 2026 lost roughly $290 million to an exploit that targeted cross-chain infrastructure. Incidents of this kind touch DeFi protocols, wallet infrastructure and smart contracts alike, reaching sentiment, investor losses and the industry's overall safety record. Projects built on embedded wallet technology and Cosmos-related assets have been hit directly, and repeated security failures could damage their market standing further. So far there is no proven link between the Web3Auth exploit and the declines across the broader market, including assets like Bitcoin and Ethereum.

On-Chain Trace Confirms the Root Cause

What makes this incident verifiable rather than rumor is the on-chain record: the $6 million drain across more than 44,000 addresses can be traced on public explorers, and the root cause, confirmed by Web3Auth itself, sits in the authentication provider's infrastructure rather than in Keplr's core signing. The described compromise path centered on social-login provisioning, not wallets where users hold their own seed phrase. What has not appeared is a formal post-mortem: the company has acknowledged the infrastructure issue, suspended the service and begun recovery, but it has not explained how the keys leaked or which engineering changes will prevent a repeat. For TWT holders, Trust Wallet's confirmed non-impact keeps the token outside this event's direct blast radius, and the open risk now sits with the third-party integrations still unconfirmed.