Web3
Latest news, analysis, and updates on Web3 from A47 News.
2 stories in Crypto · Updated live
Web3Auth Pauses Embedded Wallet Service After Key Exposure Hits Keplr Social Login Users
Web3Auth paused its embedded wallet service on November 6, 2026, after a security flaw exposed private keys for third-party integrations, with roughly $6 million in unauthorized outflows reported from Cosmos and Injective addresses. The trigger was the discovery of vulnerabilities in multi-party computation social login infrastructure used by Keplr, which led Keplr to disable Google and Apple login options on November 7 while Web3Auth executed white-hat transfers recovering about $5.6 million. The incident is likely to accelerate scrutiny of concentration risk in embedded wallet providers and push wallet developers toward more diversified key management and independent security audits.
Latest Stories
Web3Auth Pauses Embedded Wallet Service After Key Exposure Hits Keplr Social Login Users
Web3Auth paused its embedded wallet service on November 6, 2026, after a security flaw exposed private keys for third-party integrations, with roughly $6 million in unauthorized outflows reported from Cosmos and Injective addresses. The trigger was the discovery of vulnerabilities in multi-party computation social login infrastructure used by Keplr, which led Keplr to disable Google and Apple login options on November 7 while Web3Auth executed white-hat transfers recovering about $5.6 million. The incident is likely to accelerate scrutiny of concentration risk in embedded wallet providers and push wallet developers toward more diversified key management and independent security audits.
Polymarket Commits $3.9M Refund Package After Third-Party Script Compromise Drains 726 Wallets
On October 29, 2026, a compromised DebugBear performance-monitoring script served via Polymarket's CDN drained approximately $2.7 million from 726 wallets with active sessions, and the platform published a $3.9 million compensation package on October 30 that includes $1.2 million in pause-related goodwill payments. The trigger was the loading of an untrusted third-party JavaScript asset that could access signed-in browser sessions, which Polymarket detected before halting trading, removing the script, resetting sessions, and reporting 95% of affected wallets refunded by the afternoon of October 30. The long-term implication is heightened industry scrutiny of subresource integrity and third-party script governance in web-based blockchain applications, with likely tightening of vendor vetting and session-isolation practices across decentralized platforms.