Web3Auth, the embedded wallet provider now folded into MetaMask under Consensys, has temporarily paused its embedded wallet service after identifying a critical security issue. The company says there is no evidence that MetaMask users were affected. The same cannot be said for everyone who built on top of its infrastructure: Keplr Wallet, a widely used wallet in the Cosmos ecosystem, has disabled its Google and Apple sign-in options in response.

The pause took effect on November 6, 2026, at approximately 21:13 UTC. According to Web3Auth, the shutdown was carried out to investigate the potential impact of the issue. The fallout landed hardest on third-party integrators, chief among them Keplr.

How the Issue Spread to Keplr

Keplr relied on Web3Auth to power social logins, allowing users to sign in with Google and Apple accounts instead of managing a seed phrase. Keplr reported unauthorized transactions beginning around November 6, the same date Web3Auth flagged its issue. After tracing the problem back to Web3Auth, Keplr disabled its Google and Apple login options on November 7 to limit further risk.

Exposure was not uniform across Keplr's user base. Roughly 20% of Keplr users who relied on social logins could have been affected, according to figures tied to the incident. The pattern indicates the exposure was tied to the social-login flow itself.

Blockchain tracking data linked to the breach shows approximately $6 million in outflows, with funds moving from more than 44,000 Cosmos addresses and about 7,600 Injective addresses. Web3Auth has contested that loss figure, so the $6 million should be read as an estimate drawn from onchain flows rather than a confirmed tally of stolen funds.

The company has also begun recovery measures, including so-called white-hat transfers, which move assets out of vulnerable wallets and into verified addresses before an attacker can reach them. The final amount secured through these operations is not yet known.

Not everyone was caught in the blast radius. Trust Wallet and standard MetaMask accounts were found to be unaffected, and Keplr accounts that did not use social login also remained untouched.

Why Social-Login Wallets Are Under Scrutiny

Embedded wallets with social login are designed to solve one of crypto's oldest usability problems: the seed phrase. Social login lets users sign in the way they would with any mainstream app, while a third party handles much of the key management behind the scenes so the user never has to.

Many of these setups rely on multi-party computation (MPC). In simple terms, MPC splits control of a private key across multiple parties, so no single piece is sufficient on its own to move funds. On paper, that spreads risk across participants. In practice, the incident highlights that the arrangement also introduces a dependency: if the provider handling part of the process has a flaw, every application built on it may inherit that flaw.

What This Means for Wallets, Users, and Builders

For developers, the incident raises pointed questions about concentration risk. When many wallets plug into the same embedded wallet provider, a single issue can ripple across multiple ecosystems at once, in this case reaching both Cosmos and Injective users through a single integration. Keplr's rapid decision to disable social logins acted as the emergency brake.

For MetaMask and Consensys, the reassurance that MetaMask users show no signs of compromise will carry significant weight for the integration plan going forward.

Several open questions remain worth watching. The first is the final accounting: whether Web3Auth's dispute of the $6 million figure produces a materially different number. The second is how much of the exposed value the white-hat transfers manage to secure. The third is when, and under what conditions, Web3Auth restores its embedded wallet service and Keplr re-enables social logins.

Source: CryptoBriefing