The Web3Auth breach put the risk in the convenience layer of wallet sign-in rather than in an exchange's vault. Keplr disabled its Google and Apple logins after a Web3Auth security breach that Whale Alert reported drained about $6.01M from Cosmos wallets [1].
What happened
Web3Auth said it was aware of a security issue affecting its services used by some third parties and had temporarily paused its embedded wallet service. After an initial investigation, it said it had found "no evidence that MetaMask users are impacted" [2]. Keplr's response, according to Whale Alert, was to switch off its Google and Apple login options [1]. Whale Alert's report put the losses in Cosmos wallets, while Web3Auth's statement addressed MetaMask users [1][2].
Changpeng Zhao pointed anyone who had used a "social login" for a crypto wallet to Web3Auth's disclosure, telling them to research it further to protect their funds, and wrote "Self custody = self responsibility." [2]
Between two kinds of trust
Coin Bureau's custody explainer framed the choice as two kinds of trust: "The paper asks you to trust yourself." On the other side was a database that "asks you to trust a company, its engineers, and the laws of whichever country it calls home" [3]. The Web3Auth episode sits between the two. Zhao framed it as a self-custody matter, while Keplr's access path ran through Google and Apple sign-in [2][1].
A second compromise, a different stack
At 19:46 UTC, Whale Alert relayed that LNbits had urged operators to take Lightning Network servers offline after security compromises and reported unauthorized withdrawals [4]. Nothing in the rows cited here links the two incidents.
On the same theme of account access, KuCoin asked whether passing a liveness check is enough, citing AI-generated deepfakes and facial spoofing, and promoted its multi-layer identity verification [5].
