# SZB-ea46f00bd9: Web3Auth flaw exploited to drain Keplr wallets, companies say

Some Keplr wallets set up with Google or Apple sign-in have had funds stolen by an attacker who used a security flaw at Web3Auth, which provides that sign-in.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Web3Auth
- Product: Keplr wallet Google and Apple sign-in
- Status: Reported, not confirmed
- Sources: 1 distinct
- First seen: 2026-11-09 11:38 UTC

> No statement or filing from Web3Auth has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

Some Keplr wallets set up with Google or Apple sign-in have had funds stolen by an attacker who used a security flaw at Web3Auth, which provides that sign-in. Keplr and Web3Auth both said late last week that the flaw was exploited, and Web3Auth moved funds from other at-risk wallets to protect them.

## What to do

- Check Keplr wallets linked to Google or Apple sign-in for unauthorized transactions.
- Move remaining funds to a wallet you control with a seed phrase or hardware key, if you are able to do so safely.
- Follow official guidance from Keplr and Web3Auth before reconnecting social sign-in.
- Be wary of unsolicited messages offering recovery help or claiming to be from either company.

## Timeline

- 2026-11-09 10:56 UTC: Made public by The Hacker News
- 2026-11-09 11:38 UTC: First seen by cve.now

## Evidence (1 source)

- 2026-11-09 · Press · [The Hacker News](https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html): “The attacker used a security flaw at that company to reach the wallets, both companies said late last week.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-ea46f00bd9&body=https%3A%2F%2Fcve.now%2FSZB-ea46f00bd9%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-ea46f00bd9

### Has Web3Auth confirmed it?

The Hacker News reports it. No statement from Web3Auth has reached cve.now yet.

Source: https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html

### What should Web3Auth users do?

Check Keplr wallets linked to Google or Apple sign-in for unauthorized transactions. Move remaining funds to a wallet you control with a seed phrase or hardware key, if you are able to do so safely. Follow official guidance from Keplr and Web3Auth before reconnecting social sign-in. Be wary of unsolicited messages offering recovery help or claiming to be from either company.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-ea46f00bd9
Site guide for agents: https://cve.now/llms.txt