Keplr attributes empty balances to Web3Auth recovery
Keplr Wallet has informed users that some instances of “reduced or empty balances” in their accounts are likely a result of asset recovery efforts undertaken in conjunction with Web3Auth. This development on November 7, 2026, comes after reports of unauthorized transactions affecting users who logged into their Keplr accounts using Google or Apple credentials. The Keplr attributes empty balances issue is being addressed.
The incident stems from a private-key breach within Web3Auth’s infrastructure, a third-party provider Keplr utilizes for social logins.
Keplr attributes empty balances to recovery
Web3Auth confirmed it had initiated protective transfers from vulnerable wallets that had not yet been compromised, “utilizing the same path of the original attacker.” These pre-emptive movements, aimed at securing user funds, are believed to be the reason some users are now seeing a depleted or zero balance.
Both Keplr and Web3Auth have affirmed that recovered funds are safe, noting that some of these recovery transactions were initially misidentified as malicious activity by users.
The multichain crypto wallet, Keplr, first acknowledged reports of unauthorized activity on November 6, 2026, and confirmed its investigation with Web3Auth the following day. The core issue traces back to a vulnerability in Web3Auth’s systems, which led to the compromise of private keys for a segment of users.
Crucially, Keplr has clarified that accounts established using a traditional recovery phrase (mnemonic seed) or a hardware wallet remain unaffected, isolating the problem to those relying on Google or Apple for sign-in.
In response, Keplr has issued a stern warning to Google and Apple login users: cease all new deposits to these compromised accounts immediately. Instead, users should transfer any remaining liquid assets to a new account secured by a recovery phrase or a hardware wallet.
The company also cautioned against engaging with any unsolicited direct messages or links promising recovery, stressing that users should only trust official communications from Keplr or Web3Auth.
Immediate actions for affected users
The situation demands prompt action from potentially affected users to safeguard their digital assets. Keplr’s directive to halt deposits and move liquid funds is a critical first step. For those with staked or locked assets, the recovery process is significantly more complex and will likely take longer, according to Keplr.
This complication highlights a key challenge in crypto asset recovery, where liquidity and accessibility vary based on the asset’s state.
Web3Auth is actively preparing a verified list of recovery addresses. This list aims to provide clarity for users and blockchain teams, allowing them to differentiate legitimate recovery transfers from potentially malicious transactions. It’s a vital measure to prevent further confusion and potential re-victimization.
Until this list is public, users are advised to exercise caution and not assume an unfamiliar destination address necessarily belongs to an attacker.
The incident also underscores the intricate web of dependencies within the Web3 ecosystem. Keplr’s reliance on Web3Auth for its social login functionality means a vulnerability in one service can directly impact the security of another’p users.
The temporary suspension of Google and Apple login services by Keplr, and Web3Auth’s pause of its embedded wallet service, reflect the severity of the breach and the immediate need for containment.
The Web3Auth vulnerability and its mechanism
Web3Auth functions as an identity verification and wallet infrastructure provider, enabling Keplr to offer convenient social logins. For Google and Apple login accounts, Web3Auth is responsible for generating a private key rather than a traditional recovery phrase. This process often involves Distributed Key Generation (DKG), where parts of the key are created and held by multiple parties to enhance security.
However, the vulnerability in Web3Auth’s infrastructure allowed for a private-key breach, compromising this security mechanism.
Keplr Co-Founder Josh Lee clarified on November 7, 2026, that the incident was “not a hack of Keplr’s own code and that it started at Web3Auth,” further confirming that “recovery phrase and hardware wallet accounts remain safe.” Initial estimates suggest about 20% of Keplr accounts created via Google and Apple logins might be exposed, though only a fraction appear to have been fully exploited so far.
This distinction is crucial for understanding the scope of the problem. Users who adopted more traditional or robust security practices, such as using hardware wallets or securely storing mnemonic phrases, have dodged this particular threat. This incident serves as a stark reminder of the trade-offs between convenience and security in the rapidly evolving world of decentralized finance.
Broader implications for crypto wallet security
The Keplr-Web3Auth security incident sends ripples through the broader cryptocurrency ecosystem, particularly highlighting the vulnerabilities inherent in third-party authentication services for non-custodial wallets.
While Keplr itself is a non-custodial wallet — meaning users theoretically control their private keys — the compromise through Web3Auth demonstrates that the security chain is only as strong as its weakest link.
For instance, recent actions by regulators against digital asset platforms underscore the increasing scrutiny over financial integrity within the sector, as seen with FinCEN orders against MEXC Global.
This event could erode trust, especially among newer users who might be drawn to the ease of social logins. It also fuels a broader narrative of caution within the crypto space. The market