On November 7, 2026, Keplr reported unauthorized transactions on some accounts created with Google or Apple login, prompting a pause in those login methods. Later that day, Web3Auth disclosed a security issue in its infrastructure affecting certain embedded wallets used by Keplr. This incident has raised concerns about the safety of private keys for affected users.
Keplr's security documentation, last updated in September 2025, explains that Google-login accounts receive a hexadecimal private key generated through Web3Auth, which is encrypted and stored locally on the user's device. While Keplr offers a View Private Key option, the current pause does not guarantee that every locked-out user can access this feature. The documented import route using a saved private key does not serve as a tested workaround for this incident.
Keplr advised potentially affected users to avoid sending new funds and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. Importing the same private key into another interface changes access software but does not establish the key's safety. Web3Auth and its partners have begun whitehat recovery activities targeting vulnerable Keplr wallets not yet impacted, using the original attacker's path.
Earlier incidents, such as the Ledger/Cosmos access outage and Phantom's Sui cutoff, have shown how wallet interfaces can constrain practical access. The current incident underscores the importance of having an independent access path before a provider becomes unavailable. Restoring login service would address availability but not necessarily account-level impact or asset recovery.