Threat video1:00
Web3Auth Key Breach Drains Keplr Wallets: Detection & IOCs
Web3Auth's login service leaked private keys for some Keplr users, with thefts from 2026-11-06 and 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for Web3Auth Key Breach Drains Keplr Wallets: Detection & IOCs →
Chapters
- 0:00The hookKeplr sign-in breach: about $1M stolen, GoPlus says.
- 0:05The storySweeps began; Keplr paused sign-ins.
- 0:12Attack pathA sign-in flaw exposed private keys.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise2 indicators to hunt: 1 domain and 1 hash.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to impact.
- 0:43Remediation5 steps now: Do not send new funds to Keplr accounts created.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Keplr sign-in breach: about $1M stolen, GoPlus says.
0:05Sweeps began; Keplr paused sign-ins.
0:08About two hours later, the largest wave.
0:12A sign-in flaw exposed private keys.
0:14First sweep: ten wallets each sent under two cents.
0:18The largest wave bundled up to six wallets.
0:21Funds sit in recovery wallets; control is unverified.
0:27No threat actor is attributed. Confidence: low.
0:322 indicators to hunt: 1 domain and 1 hash.
0:385 ATT&CK techniques, from initial access to impact.
0:435 steps now: Do not send new funds to Keplr accounts created.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.