Web3Auth Breach Exposes Keplr Keys, $6M Drained From 44,000 Wallets

Web3Auth is in the hot seat. The wallet authentication outfit owned by Consensys confirmed a security issue that exposed private keys tied to certain Keplr wallets, and the damage is stacking up fast. Blockchain analytics firm Bitquery estimates attackers drained at least $6 million from more than 44,000 wallets across eight Cosmos ecosystem networks, including Cosmos Hub, Osmosis, Celestia and Injective.

The trouble is concentrated in embedded wallets created through Google or Apple logins, according to Web3Auth. That's the convenient, no-seed-phrase setup plenty of users never think twice about. Keplr told users to stop depositing into compromised accounts, while Web3Auth pulled its embedded wallet service offline and says it's working on recovering vulnerable assets.

Not everyone got burned. A Trust Wallet representative, Felix, said the wallet was unaffected by the November 7 incident, and MetaMask says it has no evidence of impacted users. The picture for other third-party integrations is still murky and hasn't been confirmed either way.

This lands on a market already nursing bruises from a brutal stretch of exploits. Binance was reportedly hit by a security breach involving around $6.3 billion on October 29, Bitget took an estimated $387.5 million blow in September, and earlier in 2026 KelpDAO lost roughly $290 million through cross-chain infrastructure. Wallet backends, DeFi protocols and smart contracts keep proving they're all fair game.

So far, there's no proven link between the Web3Auth mess and the broader market's slide, Bitcoin and Ethereum included. But the clock is telling: investigations and rapid protocol patches only started landing more than 24 hours after the discovery. Projects leaning on embedded wallet tech and Cosmos assets are the ones feeling it directly — and repeated security failures like this have a way of chipping at confidence long after the patches ship.