Web3Auth breach exposes Keplr wallet keys; $6M drained, says Bitquery
A Web3Auth infrastructure breach compromised some Keplr embedded wallets, with Bitquery estimating at least $6 million taken across eight Cosmos networks.
A security breach at Web3Auth, the wallet authentication infrastructure owned by Consensys, exposed private keys of some Keplr wallets, according to U.Today. The outlet cited an official statement on X from a Trust Wallet representative.
U.Today dated the incident to November 7. It said the breach led to emergency service suspensions and recovery efforts.
What was affected
Web3Auth confirmed that a security issue in its infrastructure compromised certain embedded wallets integrated with Keplr, U.Today reported. The affected accounts were mainly those created through Google or Apple login.
Blockchain analytics firm Bitquery estimated that attackers drained at least $6 million from more than 44,000 wallets, per U.Today. The wallets span eight Cosmos ecosystem networks, among them Cosmos Hub, Osmosis, Celestia and Injective. This is an estimate from one analytics firm, and U.Today did not cite a final loss figure.
Responses from wallet providers
Keplr warned users not to deposit into compromised accounts. Web3Auth suspended its embedded wallet service and said it was working on recovering vulnerable assets, according to U.Today.
MetaMask said it had no evidence of affected users, though U.Today described the situation as still developing. Trust Wallet's representative, identified as Felix, said Trust Wallet was unaffected. U.Today said the impact on other third-party integrations has not yet been confirmed.
Context and open questions
U.Today placed the breach alongside other incidents. It reported that Binance reportedly suffered a breach involving about $6.3 billion on October 29, and that Bitget was hit by an exploit estimated at $387.5 million in September. It also said KelpDAO lost about $290 million earlier in 2026 in an exploit involving cross-chain infrastructure. These figures come from the same article, and this report has no separate confirmation of them.
U.Today said there is no proven link between the Web3Auth exploit and declines across the wider market, including Bitcoin and Ethereum. It argued that repeated security failures could hurt projects that rely on embedded wallet technology and Cosmos-related assets.
Several points remain unresolved. Investigations are continuing, and patches were being released more than 24 hours after the discovery, per U.Today. Web3Auth's recovery of affected assets is still in progress. It is also unconfirmed whether other third-party integrations were affected.
Sources
Written with AI assistance from the sources above and checked against them. Not investment advice.