---
title: Web3Auth pauses its embedded wallet service over a security issue; Keplr confirms unauthorized transactions on some Google/Apple-login wallets | ctxsec
url: https://ctxsec.com/items/keplr-web3auth-social-login-wallets-unauthorized-transactions-nov-7
description: "Web3Auth (the MetaMask-owned social-login wallet provider) said on Nov 6 that it is aware of a security issue affecting its services used by some third parties, that it has temporarily paused the embedded wallet service, and that an initial investigation found no evidence MetaMask users are impacted. Hours later, Keplr Wallet said it had received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login, flagged them to Web3Auth and is investigating with them. Keplr and multiple reports say wallets created with a recovery phrase or a hardware wallet are not affected. Neither company has published a root cause, the number of affected accounts, or a loss total; dollar figures circulating on X are unconfirmed."
status: "official (Web3Auth on X, Nov 6 4:13 PM ET; Keplr Wallet on X, Nov 6 11:38 PM ET); root cause, loss totals and affected-app list not yet published"
published: 2026-11-07
---

> Web3Auth (the MetaMask-owned social-login wallet provider) said on Nov 6 that it is aware of a security issue affecting its services used by some third parties, that it has temporarily paused the embedded wallet service, and that an initial investigation found no evidence MetaMask users are impacted. Hours later, Keplr Wallet said it had received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login, flagged them to Web3Auth and is investigating with them. Keplr and multiple reports say wallets created with a recovery phrase or a hardware wallet are not affected. Neither company has published a root cause, the number of affected accounts, or a loss total; dollar figures circulating on X are unconfirmed.

[← Cybersecurity News](/news) · [markdown](/items/keplr-web3auth-social-login-wallets-unauthorized-transactions-nov-7.md)

official (Web3Auth on X, Nov 6 4:13 PM ET; Keplr Wallet on X, Nov 6 11:38 PM ET); root cause, loss totals and affected-app list not yet published

2026-11-07

### Web3Auth pauses its embedded wallet service over a security issue; Keplr confirms unauthorized transactions on some Google/Apple-login wallets

- **If your Keplr (or other dApp) wallet was created via Google/Apple social login:** do not deposit new funds to it until the provider says it is safe; if you still control it, move assets to a wallet whose seed phrase or hardware key you hold.
- Seed-phrase and hardware-wallet users are reported unaffected.
- **Expect phishing:** ignore DMs or sites offering 'recovery' — use only official Keplr / Web3Auth channels.
- **Builders:** any app that integrates Web3Auth embedded wallets should check its own status and user comms; the blast radius beyond Keplr has not been stated.

Sources: [Web3Auth on X: security issue, embedded wallet service paused (Nov 6)](https://x.com/Web3Auth/status/2118814067359969745) · [Keplr Wallet on X: unauthorized transactions on some Google/Apple-login accounts (Nov 6)](https://x.com/keplrwallet/status/2118926087615045807)