Update on the Web3Auth Security Incident

We are sharing a consolidated update on the security incident affecting Torus Wallet and certain embedded wallets used by third party applications, such as Keplr, including what happened, the steps we have taken to protect users, the status of asset recovery, and what users and developers should do next.

Our priorities throughout this incident have been to protect users, secure assets at risk, restore services safely, and provide clear, verified information as our investigation and recovery efforts progress.

What happened

On 7 November, we confirmed a security issue in Web3Auth infrastructure affecting certain embedded wallets which resulted in unauthorized access to some accounts created with Google or Apple login.

Following the identification of the issue, our engineering teams began investigating the vulnerability, assessing its potential impact and taking steps to contain the risk.

As a precaution, we temporarily paused affected embedded wallet services while implementing additional security measures.

We have been working closely with relevant third parties, including Keplr, throughout the response, including coordinating efforts to protect assets potentially exposed as a result of the incident.

What we have done to protect users

As part of our response, we initiated white-hat recovery operations, working alongside Keplr to move assets believed to be at immediate risk into secure recovery wallets.

These operations were undertaken to protect assets from potential attacker activity while the vulnerability was being addressed.

Since 8 November, we have published updates on the recovery process, including verified recovery wallet addresses across multiple blockchain networks.

Funds moved through these recovery operations are being held securely while we work with Keplr on the process of returning them to their rightful owners.

White-hat recovery activities remain ongoing across assets we believe were at immediate risk.

Asset recovery and next steps

We recognise the importance of providing affected users with clarity on the status of their assets and the process for recovering them.

We are continuing to coordinate with Keplr on the safe return of recovered funds and anticipate sharing further details on the return process in the coming days.

We have published verified recovery wallet addresses to provide transparency into the recovery operations. These can be found in our official asset recovery updates on X.

We will continue to update this information as additional addresses are verified.

Users should wait for instructions published through official channels and should not respond to unsolicited requests claiming to facilitate asset recovery.

Important: Protecting yourself from phishing and impersonation

We are aware that security incidents can create opportunities for malicious actors to target users through fraudulent recovery requests, impersonation and phishing attempts.

We urge all users to remain vigilant and follow these precautions:

Only follow recovery instructions published through official Web3Auth and Keplr channels.
Never share your seed phrase, private keys, passwords or login credentials.
Do not respond to unsolicited direct messages claiming to offer assistance with asset recovery.
Do not connect your wallet to unfamiliar websites or approve unexpected transactions.
Verify any recovery wallet addresses against those published through our official channels.

Web3Auth will never contact you through unsolicited direct messages requesting your seed phrase, private keys or login credentials. Please be particularly cautious of accounts impersonating Web3Auth, Keplr or members of our teams.

Web3Auth service restoration

Login functionality and wallet access have now resumed for existing users across our Plug & Play and Single Factor Auth (SFA) SDKs.

Some restrictions remain in place as we complete the restoration process.

Web3Auth SDKs

Web3Auth SDK (earlier called Web3Auth Plug and Play) versions 9 and older are now deprecated.

Developers using these versions should upgrade to v10 or v11 to continue using supported versions of the SDK.

Single Factor Auth (SFA) SDKs

Login functionality and wallet access have resumed for existing SFA users. However, new user registrations remain temporarily restricted.

The next steps depend on the network configuration:

Sapphire networks: Developers can enable new user registrations by migrating to our latest Web3Auth SDKs.
Legacy networks: Developers need to migrate to the latest Web3Auth SDKs and we will be enabling new user registration by November 23, 2026.

We will provide further technical guidance as these updates become available. Follow this thread to be updated on the availability and migration of different features.

Where to find verified updates

We will continue to share confirmed information as our investigation, service restoration and asset recovery efforts progress.

For the latest updates, please refer to:

Web3Auth official X account: https://x.com/Web3Auth
Initial incident update: https://x.com/Web3Auth/status/2119110953975635985
Asset recovery updates and verified addresses: https://x.com/Web3Auth/status/2119314957057871935
Latest recovery update (10 November): https://x.com/Web3Auth/status/2120305149273059520

We encourage users and developers to rely on these official sources rather than unverified information circulating elsewhere. If you need further support, you can reach out to our team at marketing@web3auth.io.

Our ongoing commitment

Our teams remain focused on completing the recovery process, restoring full service functionality and supporting affected users and partners.

We appreciate the patience, understanding and cooperation of the Web3Auth and Keplr communities throughout this process.

We will continue to provide updates as further information is confirmed.