Web3Auth, an embedded-wallet provider folded into MetaMask under Consensys, paused its service on November 6, 2026, at about 21:13 UTC after identifying a critical security issue. The company said there was no evidence that MetaMask users were affected, but the incident reached third-party integrators, including Keplr Wallet. Keplr reported unauthorized transactions and disabled Google and Apple login options on November 7. About 20% of Keplr users who relied on social logins may have been exposed, while accounts using recovery phrases or hardware wallets were outside the incident scope. Onchain tracking linked roughly $6 million in outflows to more than 44,000 Cosmos addresses and about 7,600 Injective addresses. Bitquery initially estimated $6.01 million across eight destinations, 44,041 drained wallets on seven linked chains and nearly 44,700 potential victims, with the largest individual loss at about $325,000. Web3Auth disputes the loss estimate and identified some destinations as recovery wallets used in white-hat transfers, so the initial figures do not establish a confirmed theft total. Trust Wallet, standard MetaMask accounts and Keplr accounts that did not use social login were reported unaffected. Neither company has released a final reconciliation, technical root-cause report or formal return process, and the treatment of staked and locked assets remains unresolved.