The catch in recovering a hacked crypto wallet: the thief may still have a key

A crypto wallet that lets users sign in with Google or Apple can still lock them out when its login provider stops working. Web3Auth’s security pause has exposed that dependency, alongside a more serious problem: some Keplr users’ private keys may have been compromised. In the wallet app Keplr, a previously saved, usable private key offers a documented route independent of Google login. It does not establish that an incident-affected key remains safe.On Nov. 7, @keplrwallet reported unauthorized transactions on some accounts created with Google or Apple login and said those login methods were paused. Later that day, @Web3Auth said it had identified a security issue in its infrastructure affecting certain embedded wallets used by Keplr. The disclosures turn a question about login availability into one about what users can still control if an account's key may also be exposed.Web3Auth's Login Service notice dates maintenance to Nov. 6 at 18:30 UTC and attributes it to a security incident. At 13:08 UTC on Nov. 8, its status page still promised an update when service was restored. The displayed maintenance window ended Nov. 7, but that endpoint did not confirm restoration.The Nov. 7 Me...