Web3Auth disclosed the progress of the security incident: affected wallets have restored access, and the asset return process will be announced soon

Web3Auth has released the latest developments on the security incident, which previously affected some embedded wallets created through Google or Apple login due to security vulnerabilities in the infrastructure, leading to unauthorized access to some accounts. Affected services include Torus Wallet and some embedded wallets used by third-party applications like Keplr.

Currently, the affected funds are securely held by the project team, which is coordinating the subsequent return process. Specific procedures are expected to be announced in the coming days, and asset rescue operations are still ongoing. In terms of services, existing users can log in and access wallets through Web3Auth Plug & Play and Single Factor Auth (SFA) SDK, but some restrictions still exist. Web3Auth SDK v9 and earlier versions have been deprecated, and developers need to upgrade to v10 or v11. Existing SFA users can log in normally, but new user registration is temporarily restricted. Developers on the Sapphire network can open new user registration by migrating to the latest SDK, while the Legacy network plans to restore this feature by November 23, 2026.

Web3Auth reminds users to be vigilant against scams impersonating official asset recovery services, and not to disclose their mnemonic phrases, private keys, or login credentials to anyone, nor to trust private messages that actively offer asset recovery services.