Web3Auth Flaw Exploited to Steal Keplr Crypto Wallets

# Web3Auth Flaw Exploited to Steal Keplr Crypto Wallets

https://gcdradar.vercel.app/incidents/web3auth-flaw-exploited-to-steal-keplr-crypto-wallets · AIR-2026-1831 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild resulting in actual cryptocurrency theft.
- Fix status: No fix needed
- First reported: 2026-11-09
- AI role: No AI role
- Products: Web3Auth, Keplr

## Summary

Attackers exploited a security vulnerability in Web3Auth, which handles Google and Apple sign-ins for Keplr crypto wallets, to steal funds from users. In response, the provider preemptively emptied other at-risk wallets to protect them from further theft.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-09: Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety (https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html)

## Sources

- 2026-11-09 The Hacker News: Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.