Web3 Daily Exploits — 8 Nov 2026: Quiet Window, Keplr Web3Auth ~$6M Update

The 8 Nov America/Panama window records no first-reported protocol or smart-contract incidents with confirmed scored user losses. Monitored accounts (DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news) produced no new material first-reports of drains with fresh loss figures in the last 24 hours. The Keplr Wallet / Web3Auth social-login incident, first reported on 6 November, receives a material update: Bitquery traced at least ~$6.01M from 44,041+ wallets across Cosmos chains, and Web3Auth/Keplr published verified recovery addresses after some protective sweeps were misflagged as attacker activity. Prior items remain UPDATEs: Loopscale contained attempts (vaults made whole, $0 user loss), FLOKI bot (loss undisclosed), TENDRIL sell-hook (~$555K prior), Binance hot-wallet signing compromise, and Mercado Bitcoin. Combined live scored loss on this card is ~$0.

Keplr Wallet / Web3Auth — multi-chain Cosmos — ~$6.01M traced — social-login key exposure (UPDATE)

What happened: Beginning 6 November 2026, users reported unauthorized transactions from Keplr wallets created with Google or Apple social login. The issue originated in Web3Auth (Consensys-owned), the third-party service that generates and manages keys for those embedded/social accounts. Keplr confirmed reports on 7 November, paused Google/Apple logins, and stated that recovery-phrase and hardware-wallet accounts were unaffected. On 7–8 November Bitquery published an investigation tracing at least $6.01M held by attacker-controlled addresses from a minimum of 44,041 wallets across Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon and related chains; 86% of the drains occurred after Keplr’s warning, and 1.96M staked ATOM was moved without the normal 21-day unbonding. Web3Auth, assisted by Keplr, has been sweeping remaining vulnerable balances to secure recovery wallets; on 8 November both parties published verified recovery address lists (Cosmos variants plus EVM 0x413e4F4De7E5FF010913488F781E679e76f706dA and others) so that protective transfers are not mistaken for theft. Users are advised to move any remaining funds from social-login accounts to seed or hardware wallets, stop new deposits, and ignore unsolicited recovery offers.

Protocol / chain / asset: Keplr Wallet (Cosmos multi-chain) accounts that used Web3Auth social login (Google/Apple). Chains include Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, Agoric and others. Assets: various Cosmos tokens including ATOM (including staked), OSMO, etc.

Loss: Bitquery: at least $6.01M held by the traced attacker addresses from ≥44,041 wallets. Exact final user-loss figure and recovery percentage remain open; some balances emptied by official recovery sweeps. Live scored on this brief: not newly assigned (UPDATE to prior first-report). Flag any later quantified net loss or recovery total as material.

Attack type: Key exposure via third-party authentication/key-management infrastructure (Web3Auth). Not a compromise of Keplr wallet code itself. Affected only social-login accounts; seed-phrase and hardware wallets unaffected per official statements.

Explorer URLs: Bitquery investigation: https://bitquery.io/investigations/keplr-wallet-hack. Keplr official posts: https://x.com/keplrwallet/status/2119316885737177339 (recovery addresses). Web3Auth recovery update: https://x.com/Web3Auth (thread 8 Nov). Full on-chain tx lists in Bitquery report.

Status: Confirmed by Keplr and Web3Auth. Investigation and recovery ongoing. Social logins paused. Recovery addresses published 8 Nov. No final reimbursement plan published at cutoff. Flag unverified third-party loss totals beyond the Bitquery trace.

Sources: Bitquery; Keplr Wallet X; Web3Auth X; CoinCentral; crypto.news; Odaily.

Also noted

• Loopscale Solana contained attempts (UPDATE, not re-scored): Incident first reported 5–6 November. Vaults made whole, no user deposits lost. No material new loss figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-06-nov-2026-loopscale-floki-bot-pause/.
• FLOKI Telegram trading bot (UPDATE, not re-scored): Announced early 5 November. Loss size still undisclosed. Prior coverage in the 6 Nov brief.
• TENDRIL sell-hook (UPDATE, not re-scored): ~$555K USDT on BNB Chain. No material new figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-05-nov-2026-tendril-555k-sell-hook/.
• Binance hot-wallet signing-access compromise (UPDATE, not re-scored): ~$6.3 billion multi-chain drain from 29 October remains prior. No material new scored loss in the last 24 hours. Lookonchain noted TornadoCash-funded activity on Hyperliquid (ETH to ZEC, BTC long / ETH short) consistent with prior fund movement, not a new protocol incident.
• Mercado Bitcoin multi-chain signing drain (UPDATE, not re-scored): First reported 2 November. No material new loss figures used for scoring today.
• Other notes: No additional first-report protocol drains with fresh confirmed user-loss figures from monitored accounts. Scattered individual seed or device reports remain unverified and unattributed to any protocol. DefiLlama hacks page shows no new protocol additions beyond prior entries in the recent window.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol drains with fresh confirmed user-loss figures.

Sources and references

• Bitquery Keplr investigation: https://bitquery.io/investigations/keplr-wallet-hack
• Keplr recovery addresses: https://x.com/keplrwallet/status/2119316885737177339
• Web3Auth recovery update (8 Nov): https://x.com/Web3Auth
• CoinCentral Keplr coverage: https://coincentral.com/keplr-halts-google-and-apple-logins-as-web3auth-breach-hits-up-to-20-of-social-accounts/
• 7 Nov brief: https://www.rektradar.xyz/web3-daily-exploits-07-nov-2026-quiet-window-no-new-scored/
• 6 Nov brief (Loopscale / FLOKI): https://www.rektradar.xyz/web3-daily-exploits-06-nov-2026-loopscale-floki-bot-pause/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh scored user-loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is ~$0. No newly reported items with confirmed user losses. Keplr/Web3Auth is a material UPDATE to a 6 Nov first-report (Bitquery ~$6.01M trace, recovery addresses published). Loopscale, FLOKI bot, TENDRIL, Binance and Mercado Bitcoin remain UPDATEs. No how-to or exploit reproduction steps. Stay tuned or stay rekt.