Vendor incident, severity critical
Web3Auth flaw exploited to steal Keplr wallet funds; provider empties other at-risk wallets
Published
An attacker exploited a security flaw at Web3Auth, which runs Google and Apple sign-in for Keplr wallets, and stole crypto from some wallets set up that way. Web3Auth and Keplr confirmed the incident late in the week before publication. Web3Auth then used the attacker's own route to empty other at-risk wallets as a safety measure.
What's affected
- web3authevery version
What to do
- Check whether your wallets or users sign in through Web3Auth with Google or Apple accounts
- Contact Web3Auth or Keplr to find out whether affected wallets were emptied for safety and how to recover funds
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident web3auth-keplr-wallet-theft-2026-11References
Notice web3auth-keplr-wallet-theft-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.