CRYPTO WALLET - BREACH FOLLOW-UP SCAMS

Is my Keplr wallet affected by the Web3Auth breach? And why the "recovery" message in your DMs is the next trap.

Some Keplr wallets created with Google or Apple sign-in were hit through a flaw in Web3Auth, the service behind that login. Recovery-phrase and hardware-wallet accounts are not affected. The money is not the only thing at risk now: both companies are already warning about fake recovery links.

SB

SafeBrowz Threat Research Security Research · 8 November 2026 · 7 min read

What happened, in the companies' own words

On 7 November Keplr posted that it had "received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login", flagged it to Web3Auth, and paused Google and Apple login. Hours earlier, late on 6 November (UTC), Web3Auth had said it was aware of "a security issue affecting Web3Auth's services used by some third parties", had paused its embedded wallet service, and had found no evidence that MetaMask users were affected.

Later on 7 November Web3Auth confirmed "a security issue in Web3Auth infrastructure affecting certain embedded wallets used by Keplr". Keplr's follow-up called it "Web3Auth's infrastructure vulnerability leading to private key breach". Neither company had published a full root cause, a count of affected wallets or a total loss figure when we wrote this. Some news reports quote Keplr co-founder Josh Lee as estimating that about 20% of social-login accounts were exposed. We could not find his original statement, and it is not an official count from either company.

Why only Google and Apple login wallets

A normal crypto wallet is controlled by a recovery phrase, the 12 or 24 words you write down when you create it. That phrase stays with you. A social-login wallet works differently. It has no recovery phrase. When you sign in with Google or Apple, the key is rebuilt from pieces. MetaMask's documentation for the service, now called MetaMask Embedded Wallets (formerly Web3Auth), says it splits "a user's wallet into multiple key shares" using Shamir's Secret Sharing, so that "no single party holds the full private key", and that one of those shares is created through its network when you sign in.

That is convenient: no words to lose. Keplr does still let you export such an account's private key, and that key is exactly what a fake recovery page will ask you to paste. The design also means the wallet's security rests on the login provider's infrastructure as well as your own. When that infrastructure has a flaw, wallets built on it can share the exposure. Web3Auth says this incident affected certain embedded wallets used by Keplr, and Keplr says wallets made with a recovery phrase or a hardware wallet were not affected.

Why your balance may be empty even if you were not robbed

This part is confusing, and scammers will use the confusion. Web3Auth said it began "whitehat recovery activities targeting vulnerable but not yet impacted wallets utilizing the same path of the original attacker". In plain terms, the defenders moved funds out of exposed wallets before the attacker could, using the same weakness.

So some wallets "may already show a reduced or empty balance as a result of these mitigation efforts", in Keplr's words, and Web3Auth said "some of these transactions have been mistaken for activity by the attacker". It said funds recovered this way "are safe", that it is preparing "a verified list of recovery addresses", and that people should not assume an unfamiliar destination address belongs to the attacker. Staked and locked assets, Keplr added, "add complexity and take longer".

An empty balance with no explanation is exactly the moment a stranger's message offering to "get it back" feels believable. That is the scam to prepare for.

The fake recovery messages to expect

Keplr's first post already told users to "Ignore DMs or links offering 'recovery'", and Web3Auth warned that anything not from official sources "may be phishing or other misleading attempts". Big wallet incidents follow a familiar pattern, and these are the shapes the follow-up usually takes:

• The "eligibility checker". Keplr says it is working with Web3Auth "on a way to check whether your account is affected". Scammers will build their own first: a page that says "check if your wallet was affected" and asks you to connect your wallet and approve a transaction. The approval is the theft.
• The "claim your recovered funds" page. It uses the real news, the whitehat transfers and the coming list of recovery addresses, and says your share is waiting. To release it you must "verify ownership" by typing a recovery phrase or signing a message.
• The fake recovery address list. Web3Auth plans to publish real recovery addresses. A forged list can tell you to send a "verification deposit" to an address, or label the attacker's address as safe.
• Support in the replies. Expect accounts with the Keplr logo to answer people's worried posts on X with "DM us to recover your assets" or a link to a "support form". Real support does not start in your DMs.
• The "move your funds here" page. Keplr's real advice is to move liquid assets to a recovery-phrase or hardware-wallet account. A fake page copies that advice and gives you its own "safe wallet" to move them to.

The addresses tend to borrow the brand. Illustrative examples, made up for this post and not real sites: keplr-recovery.app, claim-keplr.xyz, or keplr.app.recover-assets.com, which starts with the real name but belongs to whoever owns recover-assets.com. Keplr's real website is keplr.app, and its official updates come from @keplrwallet and @Web3Auth on X.

Red flags in any Keplr "recovery" message

• It arrived as a DM or a reply. Both companies say recovery details will come through their official channels.
• It asks for your recovery phrase or private key. No real recovery needs them. Anyone who has your phrase or key has your wallet.
• It asks you to connect a wallet and approve something to "check" or "claim". Only act on a process announced by @keplrwallet or @Web3Auth, and reach it by typing keplr.app yourself, never through a link someone sent you.
• It gives you an address to send funds to. Move your assets only to a recovery-phrase or hardware-wallet account you created yourself.
• The address is not keplr.app. A real Keplr page ends in keplr.app, at the very end of the site's name.
• It promises a deadline. "Claim within 24 hours" is pressure, not process.

What to do now if you used Google or Apple login

1. Do not send new funds to the Google or Apple login account.
2. Create a new wallet with a recovery phrase, or use a hardware wallet, and write the phrase down offline. Then move any remaining liquid assets there, as Keplr advises.
3. Do not re-import or recreate the affected account anywhere else, which Keplr advised in its first post.
4. If your balance is lower than expected, do not chase it through a stranger. Wait for the verified recovery details from @keplrwallet or @Web3Auth.
5. If you already typed a recovery phrase or private key into a recovery site, or signed something there, treat that wallet as lost: move anything left in it to a new wallet at once, before anything else. After that, revoke any permissions you granted, using tools you reach yourself rather than from a link: an approval checker for Ethereum-style tokens, and an authz revoke tool for Cosmos chains.

Stop the fake Keplr recovery page before you connect

Most versions of this follow-up scam need you to open a page that looks like Keplr and then connect your wallet or paste a key. SafeBrowz checks a link before the page loads, in the browser extension for Chrome, Firefox and Edge and in the Android app, so the warning comes before the connect button.

Keplr is one of the 550+ brands in our detection database, with keplr.app as its official domain. On our web checker, an address that joins "keplr" to other words with a hyphen, like the first two examples above, or puts keplr.app in front of someone else's domain, like the third, comes back as brand impersonation from the address alone. A name that runs keplr into another word without a hyphen is passed to the AI deep scan with a note that it uses the Keplr name, and the page is judged on what it shows. On the free web checker, a new address counts toward the one free scan a day, the address rule included.

Now the honest limit. A misspelling such as "kepler" does not match the name rule at all, and a recovery page on a free hosting site or a link shortener may not carry the name anywhere in its address. Those depend on the AI deep scan reading the page, one a day free on the web checker and unlimited in Premium, or on the page being reported and added to our block list. No link scanner replaces the rule above: no real recovery asks for your recovery phrase or private key, and any signature request should come only from a process announced by @keplrwallet or @Web3Auth.

For the wider picture, see our guides to how wallet drainers work, how one signature can empty a wallet, fake eligibility checkers and what to do if your wallet was drained.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play