Web3Auth Infrastructure Flaw Exploited to Drain Keplr Wallets Created via Google/Apple Sign-in (Private Key Breach)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5547 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web3Auth/Keplr Automated Sweep - Reward Redirect + Share Tokenization + Transfer Bundles

Behaviour-first on-chain detection of the TL-2026-5547 Web3Auth/Keplr key-material sweep: transactions that combine a staking-reward redirect (MsgSetWithdrawAddress), liquid-share tokenization (MsgTokenizeShares) and an outbound send, repeated by one fee payer. This converts stake to liquid shares and bypasses the 21-day unbonding period. Also flags the Cosmos Hub gas wallet that signed the 2,520 sweep transactions. Destinations may be Web3Auth whitehat recovery wallets, so triage with SPL-002 and KQL-001.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1020, T1657, T1078
• Data sources: cosmos_node_tx_logs (custom ingest: index=blockchain sourcetype=cosmos:msg / table CosmosTx_CL)
• Severity: critical
• Confidence: high

Splunk SPL

index=blockchain sourcetype="cosmos:msg" earliest=-24h msg_type IN ("*MsgSetWithdrawAddress","*MsgTokenizeShares","*MsgSend","*MsgTransferTokenizeShareRecord") | eval kind=case(match(msg_type,"MsgSetWithdrawAddress"),"reward_redirect",match(msg_type,"MsgTokenizeShares"),"tokenize_shares",match(msg_type,"MsgSend$|MsgTransferTokenizeShareRecord"),"send_out") | stats dc(kind) as kinds values(kind) as sequence dc(signer) as wallets_in_tx values(recipient) as dest min(_time) as first_seen by tx_hash fee_payer chain_id | where kinds=3 AND wallets_in_tx>=1 | stats dc(tx_hash) as sweep_txs sum(wallets_in_tx) as wallets_swept max(wallets_in_tx) as max_wallets_per_tx values(dest) as destinations min(first_seen) as first_seen by fee_payer chain_id | where sweep_txs>=3 OR fee_payer="cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0" | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), known_sweep_gas_wallet=if(fee_payer="cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0","yes","no") | table first_seen chain_id fee_payer known_sweep_gas_wallet sweep_txs wallets_swept max_wallets_per_tx destinations

Microsoft KQL

CosmosTx_CL
| where TimeGenerated > ago(24h)
| where MsgType_s has_any ("MsgSetWithdrawAddress", "MsgTokenizeShares", "MsgSend", "MsgTransferTokenizeShareRecord")
| extend Kind = case(MsgType_s has "MsgSetWithdrawAddress", "reward_redirect", MsgType_s has "MsgTokenizeShares", "tokenize_shares", "send_out")
| summarize Kinds = dcount(Kind), WalletsInTx = dcount(Signer_s), Dest = make_set(Recipient_s, 10), FirstSeen = min(TimeGenerated) by TxHash_s, FeePayer_s, ChainId_s
| where Kinds == 3
| summarize SweepTxs = dcount(TxHash_s), WalletsSwept = sum(WalletsInTx), MaxWalletsPerTx = max(WalletsInTx), Destinations = make_set(Dest, 20), FirstSeen = min(FirstSeen) by FeePayer_s, ChainId_s
| where SweepTxs >= 3 or FeePayer_s == "cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0"
| project FirstSeen, ChainId_s, FeePayer_s, SweepTxs, WalletsSwept, MaxWalletsPerTx, Destinations

Sigma

title: Web3Auth/Keplr Sweep - Sponsored Reward Redirect or Share Tokenization (TL-2026-5547)
id: 3f1c2a54-8b6d-4e07-9a31-5c7d0e1b2a01
status: experimental
description: Detects Cosmos staking-reward redirect or liquid-share tokenization messages whose gas is paid by a different account than the signer, or any transaction fee-paid by the known sweep gas wallet. Mirrors the automated Web3Auth/Keplr sweep pattern.
references:
    - https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html
    - https://bitquery.io/investigations/keplr-wallet-hack
    - https://intel.threadlinqs.com/threats/TL-2026-5547
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.exfiltration
    - attack.t1020
    - attack.impact
    - attack.t1657
    - attack.defense_evasion
    - attack.t1078
logsource:
    product: cosmos
    service: tx
detection:
    selection_ioc:
        fee_payer: 'cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0'
    selection_seq:
        msg_type|endswith:
            - 'MsgSetWithdrawAddress'
            - 'MsgTokenizeShares'
    sponsored:
        fee_payer_is_signer: false
    condition: selection_ioc or (selection_seq and sponsored)
falsepositives:
    - Fee-grant (feegrant module) sponsored transactions from legitimate dApps
    - Custodial staking services that tokenize shares on behalf of customers
level: high

Known false positives:

• Fee-grant sponsored batches from legitimate wallet or dApp relayers
• Authorized Web3Auth/Keplr recovery operations (whitehat rescue) that use the same bundle pattern

Tuning notes: Requires one-row-per-message Cosmos tx ingest (fields tx_hash, fee_payer, signer, msg_type, recipient, chain_id); adjust field names to your pipeline. Raise the sweep_txs threshold on busy chains; allow-list known relayers and the Web3Auth recovery operator once verified.

• 🔒 Sweep Gas Wallet and Published Recovery Wallet IOC Match · unlock with TL Creds
• 🔒 Managed-Device Access to Web3Auth/Keplr Social-Login Endpoints (Exposure Hunt) · unlock with TL Creds
• 🔒 Single Gas Payer Sponsoring Mass Multi-Wallet Sweep Messages · unlock with TL Creds
• 🔒 Staking Reward Withdraw Address Redirected to Another Account · unlock with TL Creds
• 🔒 Liquid-Share Tokenization to Another Owner (Unbonding Bypass) · unlock with TL Creds
• 🔒 Proxy Access to keplr.to and my-settings-google.com Phishing Clones · unlock with TL Creds
• 🔒 Fan-in: 20+ Wallets Sending to One Destination (Recovery vs Unlisted) · unlock with TL Creds
• 🔒 DNS Lookup of apple-Lookalike .top/.xyz Domains (Sysmon EID 22) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5547.

Sample indicators (1 of 17)

• File hash: D1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

Keplr, a Cosmos-ecosystem wallet, relies on Web3Auth (acquired by Consensys in June 2025) for social-login (Google/Apple) wallets. On 2026-11-06 Web3Auth disclosed a security issue in its own infrastructure affecting certain wallets it provides inside the Keplr app, and Keplr described a 'private key breach' for some users who signed in with Google or Apple. Wallets created from a recovery phrase or a hardware wallet are reported as not affected. The root cause, the vulnerable component or version, the CVE, the attacker identity and whether the route has been closed have not been publicly disclosed. No CVE or CVSS has been assigned; severity is analyst-assigned from confirmed fund theft.

On-chain analysis by Bitquery (verified 2026-11-08) shows the first automated sweep at 2026-11-06 20:52 UTC, when ten Cosmos Hub wallets each sent under two cents. Web3Auth's first public notice and pause of its embedded wallet service came 21 minutes later. Keplr warned users of unauthorized transactions and paused Google/Apple login at 2026-11-07 04:38 UTC. About two hours after that warning the largest wave started, and roughly 86% of affected wallets were swept after the warning. Sweeps were bundled (up to six wallets per transaction) and signed by a single gas wallet that signed 2,520 transactions. Each bundle pointed staking rewards at the destination wallet, converted stake into liquid share tokens, and sent those tokens out, which bypassed the 21-day unbonding period. This pattern shows automated, mass use of the affected wallets' key material across many chains.

Attribution of the destination wallets is contested. GoPlus reported at least about $1 million stolen without explaining its method. Bitquery first reported at least $6.01M leaving 44,000+ wallets as an attacker theft, then corrected its analysis to treat the transfers as a Web3Auth 'whitehat recovery' into Web3Auth/Keplr-published recovery wallets, noting that control of those wallets rests on public statements and is not independently verified. Web3Auth says moved funds are safe and that it is working with Keplr to return them, without stating how or when. Keplr co-founder Josh Lee's early estimate was that about 20% of Google/Apple login accounts were affected, with only a fraction appearing exploited. Web3Auth says other companies' services may be affected but has named only Keplr, and its initial investigation found no evidence that MetaMask users are impacted. As of 2026-11-09 the Web3Auth status page showed an outage banner, with its Login Service among the affected components.

Defensive guidance from Keplr: do not send new funds to affected accounts, do not re-import or recreate the account elsewhere, move unstaked and unlocked funds to a recovery-phrase or hardware-wallet account, trust only official Keplr/Web3Auth channels, and ignore unsolicited recovery offers. No attacker addresses, domains, IPs or hashes were published. The IOCs below are the published recovery wallets and the gas wallet that signed the sweeps; they are listed so defenders can distinguish sanctioned rescue transfers from malicious ones and are NOT confirmed attacker infrastructure. No network IOCs exist to check against BeaconBeagle.

MITRE ATT&CK techniques by tactic:

Exfiltration

T1020 Automated Exfiltration

Defense Evasion

T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.004 Unsecured Credentials: Private Keys

Impact

T1657 Financial Theft

Remediation

Patches

• No patch, version or CVE disclosed; follow Web3Auth and Keplr announcements

Immediate actions

• Do not send new funds to Keplr accounts created with Google or Apple sign-in
• Do not re-import or recreate the affected account in any wallet
• Move unstaked and unlocked funds to a wallet created from a recovery phrase or a hardware wallet
• Ignore DMs or links offering 'recovery'; trust only official Keplr and Web3Auth accounts
• Compare any unfamiliar outbound destination against Web3Auth's published recovery address list before assuming it is attacker-controlled

Workarounds

• Keplr paused Google/Apple sign-in and Web3Auth paused its embedded wallet service during the investigation
• Keplr and Web3Auth are working on a way for users to check whether their account was affected

Longer-term hardening

• Prefer self-custody keys (recovery phrase or hardware wallet) for significant balances
• Integrators of embedded or social-login wallets should review dependence on a single key-management provider and prepare incident pause and key-rotation procedures
• Monitor on-chain for bundled staking-reward redirect, liquid-share conversion and transfer patterns from user wallets

Affected and fixed versions

• Web3Auth (Consensys) — Web3Auth login infrastructure and embedded wallet service
  Vulnerable versions: Not disclosed
  Fixed in: Not disclosed
• Keplr — Keplr wallet accounts created with Google or Apple sign-in
  Vulnerable versions: Google/Apple sign-in (Web3Auth-backed) accounts
  Fixed in: Not disclosed

Timeline

• 2025-06-01 Consensys acquires Web3Auth (June 2025), per the announcement cited by The Hacker News.
• 2026-11-06 21:13 UTC: Web3Auth issues its first public notice and pauses its embedded wallet service, 21 minutes after the first sweep.
• 2026-11-06 20:52 UTC: first automated sweep; ten Cosmos Hub wallets each send under two cents (Bitquery).
• 2026-11-07 15:38 UTC: at least $6.01M sits in recovery addresses; 44,041 wallets on seven Cosmos chains counted (Bitquery).
• 2026-11-07 16:41 UTC: Bitquery publishes first analysis attributing the transfers to an attacker; Web3Auth and Keplr dispute it and Web3Auth describes a 'whitehat recovery'.
• 2026-11-07 About two hours after Keplr's warning the largest sweep wave begins (six times the first); sweeps are bundled up to six wallets per transaction from 09:57 UTC.
• 2026-11-07 04:38 UTC: Keplr warns users of unauthorized transactions on Google/Apple login accounts and pauses that login.
• 2026-11-08 Bitquery rewrites its analysis to treat the transfers as a rescue, noting recovery-wallet control is unverified; further Osmosis and Noble transfers continue to be counted.
• 2026-11-09 Web3Auth status page still shows an outage with Login Service down; The Hacker News reports GoPlus estimate of at least ~$1M stolen and no official dollar figure from Keplr or Web3Auth.

Sources cited

• Bitquery: Keplr Wallet Hack investigation (corrected analysis) bitquery.io · Research · 2026-11-08
• Web3Auth status page (Login Service outage) status.web3auth.io · Vendor report · 2026-11-09
• Keplr user guidance (cited by The Hacker News) x.com · Vendor report · 2026-11-07
• Web3Auth incident update (cited by The Hacker News) x.com · Vendor report · 2026-11-06
• Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety The Hacker News · News · 2026-11-09

More in vulnerability

• LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit
• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux

Previous and next in vulnerability

• ModSecurity v3 RFC 2231 filename* Multipart Parser Differential Bypasses WAF Filename Rules (CVE-2026-104269) Previous report
• ModSecurity WAF Vulnerabilities: Multipart filename* Upload Bypass (CVE-2026-104269) and XML Body Processor Uninitialized Pointer Dereference (CVE-2026-73857) Next report