Keplr’s documented backups can reduce login dependence, but they cannot establish that a potentially exposed key is safe.
A crypto wallet that lets users sign in with Google or Apple can still lock them out when its login provider stops working. Web3Auth’s security pause has exposed that dependency, alongside a more serious problem: some Keplr users’ private keys may have been compromised. In the wallet app Keplr, a previously saved, usable private key offers a documented route independent of Google login. It does not establish that an incident-affected key remains safe.
On Nov. 7, @keplrwallet reported unauthorized transactions on some accounts created with Google or Apple login and said those login methods were paused. Later that day, @Web3Auth said it had identified a security issue in its infrastructure affecting certain embedded wallets used by Keplr. The disclosures turn a question about login availability into one about what users can still control if an account's key may also be exposed.
Web3Auth's Login Service notice dates maintenance to Nov. 6 at 18:30 UTC and attributes it to a security incident. At 13:08 UTC on Nov. 8, its status page still promised an update when service was restored. The displayed maintenance window ended Nov. 7, but that endpoint did not confirm restoration.
The Nov. 7 MetaMask Builder announcement said an initial investigation found no evidence MetaMask users were impacted.
Keplr's security documentation , updated in September 2025 and still available, says Google-login accounts receive a hexadecimal private key generated through Web3Auth instead of a recovery phrase.
Source link
