The catch in recovering a hacked crypto wallet: the thief may still have a key

Web3Auth and Keplr paused login services on Nov. 7 and 8, 2026, after a security incident potentially exposed private keys for some users.

Keplr reported unauthorized transactions on accounts created with Google or Apple login and said those login methods were paused.

Later that day, Web3Auth identified a security issue in its infrastructure affecting certain embedded wallets used by Keplr.

The disclosures turn a question about login availability into one about what users can still control if an account's key may also be exposed.

Security incident details

Web3Auth’s Login Service notice dates maintenance to Nov. 6 at 18:30 UTC and attributes it to a security incident.

At 13:08 UTC on Nov. 8, its status page still promised an update when service was restored.

The displayed maintenance window ended Nov. 7, but that endpoint did not confirm restoration.

An initial investigation by MetaMask Builder found no evidence that MetaMask users were impacted.

Private key backup options

Keplr's security documentation, updated in September 2025, says Google-login accounts receive a hexadecimal private key generated through Web3Auth instead of a recovery phrase.

It says the key is encrypted and stored locally on the user's device.

The same documentation describes a View Private Key option, subject to exceptions for some legacy accounts.

Keplr's mobile import guide separately documents connecting with Google and importing with a recovery phrase or private key.

It also tells Google-login users to save their private key securely.

Importing the same key

A saved key matters because the documented import route uses that secret directly, separately from Google sign-in.

But a menu that normally offers export does not establish that every locked-out user can reach it during this pause.

The documented route is not a tested workaround for this incident.

Importing the same private key into another interface can change how its owner accesses the account.

It does not change the secret authorizing it or establish that nobody else possesses it.

Portability can address an access dependency without resolving a confidentiality problem.

Recovery and next steps

Keplr's incident guidance takes precedence over routine re-import instructions.

For potentially affected accounts, Keplr advised against sending new funds and said remaining liquid assets should be moved to a recovery-phrase or hardware-wallet account.

Keplr and Web3Auth also said they and partners had begun whitehat recovery activities targeting vulnerable Keplr wallets not yet impacted.

They are using the original attacker's path to attempt recovery.

Some reduced or empty balances could reflect mitigation efforts, and staked and locked assets made the work more complex.

An unfamiliar transfer or diminished balance alone cannot establish which activity occurred.

Restoring login service would answer the availability question; it would not, by itself, settle either of the others.