cryptobriefing.com
20 m
Web3Auth, the embedded wallet provider now folded into MetaMask under Consensys, has temporarily paused its embedded wallet service after identifying a critical security issue.
The company says there is no evidence MetaMask users were affected. The same cannot be said for everyone who built on top of its infrastructure.
The pause took effect on November 6, 2026, at approximately 21:13 UTC. Web3Auth said it shut things down to investigate the possible impact of the issue.
Point your phone camera to install
4.8 based on 40K reviews in the App Store and Google Play
The fallout landed hardest on third-party integrators. Chief among them was Keplr Wallet, a popular wallet in the Cosmos ecosystem.
Keplr used Web3Auth to power social logins, letting users sign in with Google and Apple accounts instead of managing a seed phrase.
Keplr reported unauthorized transactions beginning around November 6, the same date Web3Auth flagged its issue. After tracing the problem back to Web3Auth, Keplr disabled its Google and Apple login options on November 7 to limit further risk.
The exposure was not universal across Keplr’s user base. Roughly 20% of Keplr users who relied on social logins could have been exposed, according to figures tied to the incident.
Blockchain tracking data linked to the breach shows around $6 million in outflows. Those funds moved from more than 44,000 Cosmos addresses and about 7,600 Injective addresses.
Web3Auth has contested that total loss figure. So the $6 million number should be read as an estimate drawn from onchain flows, not a confirmed tally of stolen funds.
The company has also started recovery measures. These include so-called white-hat transfers, which move assets out of vulnerable wallets and into verified addresses before an attacker can get to them.
Not everyone was caught in the blast radius. Trust Wallet and standard MetaMask accounts were found to be unaffected. Keplr accounts that did not use social login also remained untouched.
Embedded wallets with social login exist to solve one of crypto’s oldest usability headaches: the seed phrase. Social login lets users sign in the way they would with any app. Behind the scenes, a third party handles much of the key management so the user never has to.
Many of these setups rely on multi-party computation, or MPC. In plain terms, MPC splits control of a private key across multiple parties, so no single piece is enough on its own to move funds.
On paper, that spreads risk around. In practice, this incident shows the arrangement also adds a dependency: if the provider handling part of the process has a flaw, every app built on it may inherit that flaw.
For builders, the incident raises a hard question about concentration risk. When many wallets plug into the same embedded wallet provider, a single issue can ripple across multiple ecosystems at once, in this case reaching both Cosmos and Injective users through one integration.
Keplr’s quick move to disable social logins was effectively the emergency brake.
For MetaMask and Consensys, the reassurance that MetaMask users show no sign of compromise will matter a great deal to that plan.
Several open questions remain worth watching. The first is the final accounting: whether Web3Auth’s dispute of the $6 million figure results in a materially different number. The second is how much of the exposed value the white-hat transfers manage to secure. The third is when, and under what conditions, Web3Auth restores its embedded wallet service and Keplr turns social logins back on.
