# Web3Auth Infrastructure Flaw Exploited to Drain Keplr Wallets Created via Google/Apple Sign-in (Private Key Breach)

> A security issue in Web3Auth's infrastructure, which powers Google/Apple sign-in for Keplr wallets, led to a private key breach for some Keplr users and theft of funds beginning 2026-11-06. Web3Auth and Keplr paused the affected services, and Web3Auth moved funds from tens of thousands of at-risk wallets into recovery wallets.

- **Published:** 2026-11-09T12:05:27Z
- **Last reviewed:** 2026-11-09T12:05:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5547
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5547.png
- **ID:** TL-2026-5547
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (1 shown free below)

## Description

Keplr, a Cosmos-ecosystem wallet, relies on Web3Auth (acquired by Consensys in June 2025) for social-login (Google/Apple) wallets. On 2026-11-06 Web3Auth disclosed a security issue in its own infrastructure affecting certain wallets it provides inside the Keplr app, and Keplr described a 'private key breach' for some users who signed in with Google or Apple. Wallets created from a recovery phrase or a hardware wallet are reported as not affected. The root cause, the vulnerable component or version, the CVE, the attacker identity and whether the route has been closed have not been publicly disclosed. No CVE or CVSS has been assigned; severity is analyst-assigned from confirmed fund theft.

On-chain analysis by Bitquery (verified 2026-11-08) shows the first automated sweep at 2026-11-06 20:52 UTC, when ten Cosmos Hub wallets each sent under two cents. Web3Auth's first public notice and pause of its embedded wallet service came 21 minutes later. Keplr warned users of unauthorized transactions and paused Google/Apple login at 2026-11-07 04:38 UTC. About two hours after that warning the largest wave started, and roughly 86% of affected wallets were swept after the warning. Sweeps were bundled (up to six wallets per transaction) and signed by a single gas wallet that signed 2,520 transactions. Each bundle pointed staking rewards at the destination wallet, converted stake into liquid share tokens, and sent those tokens out, which bypassed the 21-day unbonding period. This pattern shows automated, mass use of the affected wallets' key material across many chains.

Attribution of the destination wallets is contested. GoPlus reported at least about $1 million stolen without explaining its method. Bitquery first reported at least $6.01M leaving 44,000+ wallets as an attacker theft, then corrected its analysis to treat the transfers as a Web3Auth 'whitehat recovery' into Web3Auth/Keplr-published recovery wallets, noting that control of those wallets rests on public statements and is not independently verified. Web3Auth says moved funds are safe and that it is working with Keplr to return them, without stating how or when. Keplr co-founder Josh Lee's early estimate was that about 20% of Google/Apple login accounts were affected, with only a fraction appearing exploited. Web3Auth says other companies' services may be affected but has named only Keplr, and its initial investigation found no evidence that MetaMask users are impacted. As of 2026-11-09 the Web3Auth status page showed an outage banner, with its Login Service among the affected components.

Defensive guidance from Keplr: do not send new funds to affected accounts, do not re-import or recreate the account elsewhere, move unstaked and unlocked funds to a recovery-phrase or hardware-wallet account, trust only official Keplr/Web3Auth channels, and ignore unsolicited recovery offers. No attacker addresses, domains, IPs or hashes were published. The IOCs below are the published recovery wallets and the gas wallet that signed the sweeps; they are listed so defenders can distinguish sanctioned rescue transfers from malicious ones and are NOT confirmed attacker infrastructure. No network IOCs exist to check against BeaconBeagle.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1552.004 Unsecured Credentials: Private Keys
- T1078 Valid Accounts
- T1020 Automated Exfiltration
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web3Auth/Keplr Automated Sweep - Reward Redirect + Share Tokenization + Transfer Bundles** (`TL-2026-5547-SPL-001`)

Behaviour-first on-chain detection of the TL-2026-5547 Web3Auth/Keplr key-material sweep: transactions that combine a staking-reward redirect (MsgSetWithdrawAddress), liquid-share tokenization (MsgTokenizeShares) and an outbound send, repeated by one fee payer. This converts stake to liquid shares and bypasses the 21-day unbonding period. Also flags the Cosmos Hub gas wallet that signed the 2,520 sweep transactions. Destinations may be Web3Auth whitehat recovery wallets, so triage with SPL-002 and KQL-001.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1020, T1657, T1078
- **Data sources:** cosmos_node_tx_logs (custom ingest: index=blockchain sourcetype=cosmos:msg / table CosmosTx_CL)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=blockchain sourcetype="cosmos:msg" earliest=-24h msg_type IN ("*MsgSetWithdrawAddress","*MsgTokenizeShares","*MsgSend","*MsgTransferTokenizeShareRecord") | eval kind=case(match(msg_type,"MsgSetWithdrawAddress"),"reward_redirect",match(msg_type,"MsgTokenizeShares"),"tokenize_shares",match(msg_type,"MsgSend$|MsgTransferTokenizeShareRecord"),"send_out") | stats dc(kind) as kinds values(kind) as sequence dc(signer) as wallets_in_tx values(recipient) as dest min(_time) as first_seen by tx_hash fee_payer chain_id | where kinds=3 AND wallets_in_tx>=1 | stats dc(tx_hash) as sweep_txs sum(wallets_in_tx) as wallets_swept max(wallets_in_tx) as max_wallets_per_tx values(dest) as destinations min(first_seen) as first_seen by fee_payer chain_id | where sweep_txs>=3 OR fee_payer="cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0" | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), known_sweep_gas_wallet=if(fee_payer="cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0","yes","no") | table first_seen chain_id fee_payer known_sweep_gas_wallet sweep_txs wallets_swept max_wallets_per_tx destinations
```

### Microsoft KQL

```kql
CosmosTx_CL
| where TimeGenerated > ago(24h)
| where MsgType_s has_any ("MsgSetWithdrawAddress", "MsgTokenizeShares", "MsgSend", "MsgTransferTokenizeShareRecord")
| extend Kind = case(MsgType_s has "MsgSetWithdrawAddress", "reward_redirect", MsgType_s has "MsgTokenizeShares", "tokenize_shares", "send_out")
| summarize Kinds = dcount(Kind), WalletsInTx = dcount(Signer_s), Dest = make_set(Recipient_s, 10), FirstSeen = min(TimeGenerated) by TxHash_s, FeePayer_s, ChainId_s
| where Kinds == 3
| summarize SweepTxs = dcount(TxHash_s), WalletsSwept = sum(WalletsInTx), MaxWalletsPerTx = max(WalletsInTx), Destinations = make_set(Dest, 20), FirstSeen = min(FirstSeen) by FeePayer_s, ChainId_s
| where SweepTxs >= 3 or FeePayer_s == "cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0"
| project FirstSeen, ChainId_s, FeePayer_s, SweepTxs, WalletsSwept, MaxWalletsPerTx, Destinations
```

### Sigma

```yaml
title: Web3Auth/Keplr Sweep - Sponsored Reward Redirect or Share Tokenization (TL-2026-5547)
id: 3f1c2a54-8b6d-4e07-9a31-5c7d0e1b2a01
status: experimental
description: Detects Cosmos staking-reward redirect or liquid-share tokenization messages whose gas is paid by a different account than the signer, or any transaction fee-paid by the known sweep gas wallet. Mirrors the automated Web3Auth/Keplr sweep pattern.
references:
    - https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html
    - https://bitquery.io/investigations/keplr-wallet-hack
    - https://intel.threadlinqs.com/threats/TL-2026-5547
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.exfiltration
    - attack.t1020
    - attack.impact
    - attack.t1657
    - attack.defense_evasion
    - attack.t1078
logsource:
    product: cosmos
    service: tx
detection:
    selection_ioc:
        fee_payer: 'cosmos1pa0n22gcyyjnv6vqe9qgphrfhyhhf52t6kqud0'
    selection_seq:
        msg_type|endswith:
            - 'MsgSetWithdrawAddress'
            - 'MsgTokenizeShares'
    sponsored:
        fee_payer_is_signer: false
    condition: selection_ioc or (selection_seq and sponsored)
falsepositives:
    - Fee-grant (feegrant module) sponsored transactions from legitimate dApps
    - Custodial staking services that tokenize shares on behalf of customers
level: high

```

**Known false positives:**

- Fee-grant sponsored batches from legitimate wallet or dApp relayers
- Authorized Web3Auth/Keplr recovery operations (whitehat rescue) that use the same bundle pattern

**Tuning notes:** Requires one-row-per-message Cosmos tx ingest (fields tx_hash, fee_payer, signer, msg_type, recipient, chain_id); adjust field names to your pipeline. Raise the sweep_txs threshold on busy chains; allow-list known relayers and the Web3Auth recovery operator once verified.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Sweep Gas Wallet and Published Recovery Wallet IOC Match (locked: unlock with TL Creds)
- Managed-Device Access to Web3Auth/Keplr Social-Login Endpoints (Exposure Hunt) (locked: unlock with TL Creds)
- Single Gas Payer Sponsoring Mass Multi-Wallet Sweep Messages (locked: unlock with TL Creds)
- Staking Reward Withdraw Address Redirected to Another Account (locked: unlock with TL Creds)
- Liquid-Share Tokenization to Another Owner (Unbonding Bypass) (locked: unlock with TL Creds)
- Proxy Access to keplr.to and my-settings-google.com Phishing Clones (locked: unlock with TL Creds)
- Fan-in: 20+ Wallets Sending to One Destination (Recovery vs Unlisted) (locked: unlock with TL Creds)
- DNS Lookup of apple-Lookalike .top/.xyz Domains (Sysmon EID 22) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 17)

Defanged, TLP:CLEAR.

- File hash: `D1F9C2224490B6C705B6065F784993C8D4CDC732F4B8A1EF939EA719873505F9`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety](https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html)
- [Bitquery: Keplr Wallet Hack investigation (corrected analysis)](https://bitquery.io/investigations/keplr-wallet-hack)
- [Web3Auth status page (Login Service outage)](https://status.web3auth.io/)
- [Keplr user guidance (cited by The Hacker News)](https://x.com/keplrwallet/status/2119117067500806350)
- [Web3Auth incident update (cited by The Hacker News)](https://x.com/Web3Auth/status/2119110953975635985)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5547