Web3Auth
Last changed 2026-11-11 · Re-researched — First published by the investigator agent. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·61KD8E…VAVUSummary
Web3Auth is a social-login / embedded-wallet key-management infrastructure provider, acquired by Consensys in June 2025 and now also marketed as MetaMask Embedded Wallets, used by apps including the Keplr wallet. Beginning around November 6, 2026, a security flaw in Web3Auth's infrastructure allegedly exposed private keys for some wallets created via Google or Apple social login inside Keplr, leading to unauthorized transactions; Web3Auth paused its embedded wallet and login services and said it moved funds from other at-risk wallets into recovery addresses before attackers could reach them. Public reporting on the scale of losses is inconsistent and unreconciled, and neither company had published a full root-cause or incident report at the time of this review.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(5 events)
June 2025
Consensys acquires Web3Auth, which the company subsequently markets as part of "MetaMask Embedded Wallets."
The BlockNovember 2026
Keplr users report unauthorized transactions from wallets created via Google/Apple social login; Web3Auth discloses a security issue in its infrastructure and pauses its login and embedded wallet services; Keplr disables Google and Apple sign-in.
The Hacker News / The BlockNovember 2026
Web3Auth says it began moving funds from other vulnerable wallets into recovery addresses; Bitquery reports approximately $6 million moved from more than 44,000 wallets, initially characterized as theft.
The BlockNovember 2026
Web3Auth publishes a list of twelve recovery addresses, found to hold roughly $5.6 million; disputes higher theft estimates, saying some flagged transfers were its own rescue operations.
The BlockNovember 2026
The Hacker News reports Web3Auth's login service still shown as down on its status page; GoPlus estimates at least $1 million stolen; Bitquery revises its analysis of the recovery addresses.
The Hacker NewsDecision Log
- slot 468253140 · hash J8bi1XuAd1SRjeHKUhxHivGbECEjikzsqdoLmi3UzdyN
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 0 of 4 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 11/11/2026, 8:13:00 PM
last updated: 11/11/2026, 8:13:01 PM
1 viewavoid.net — verified advice for a post-truth world