Originally reported by ChainCatcher on November 14, 2026, at 13:28 (UTC+8). Web3Auth said an infrastructure security vulnerability had affected some embedded wallets created through Google or Apple login, resulting in unauthorized access to some accounts. The affected services included Torus Wallet and some embedded wallets used by third-party apps such as Keplr.
According to Web3Auth, the project team was securely holding affected funds and coordinating their return. It expected to publish the return process in the following days, while asset recovery efforts continued. No return procedure was available in this update.
For developers and users, the service status was:
- Existing users: Login and wallet access through the Web3Auth Plug & Play and Single Factor Auth (SFA) SDKs had been restored.
- SDK versions: Web3Auth SDK v9 and earlier had been deprecated; developers needed to upgrade to v10 or v11.
- SFA signups: Existing users could log in, but new-user registration remained restricted. Developers on the Sapphire network could enable registration by migrating to the latest SDK. Web3Auth planned to restore registration on the Legacy network by November 23, 2026.
Web3Auth also warned users about scammers impersonating official asset-recovery services. Do not disclose a recovery phrase, private key or login credentials, or trust unsolicited messages offering to recover assets.