Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety

thehackernews.com Nov 9, 2026

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety

Curated by Shubham · TechCapsules · Nov 9, 2026

AI-summarised brief · reviewed before publication

Keplr wallet users who logged in with Google or Apple accounts suffered theft after a vulnerability in Web3Auth, the provider of the social‑login service, was exploited. The flaw gave the attacker access to private keys, allowing funds to be moved from compromised wallets. Web3Auth responded by using the same breach path to transfer assets from at‑risk accounts into designated recovery wallets before the thief could act, a process coordinated with Keplr. The rescue operation covered more than 44,000 wallets and moved over $6 million across Cosmos and Ethereum‑compatible chains. Wallets secured with recovery phrases or hardware devices were unaffected. Keplr has paused social‑login options, is investigating, and is working with Web3Auth to verify which accounts were impacted and to restore funds.

💡 Why It Matters

· The breach shows that convenient social‑login mechanisms can become a single point of failure for crypto custody, prompting a reassessment of authentication strategies in decentralized finance.

Read full article on thehackernews.com

LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers…

LNbits, an open‑source Bitcoin Lightning wallet platform, warned all operators to shut down their servers after a series of attacks exploited a vulnerability in the software. One operator reported that an attacker used an unknown extension to siphon 2,285,545 satoshis (≈0.023 BTC) from his instance before the warning was issued. The project issued an initial advisory at 12:33 UTC, asking users to disable the Paywall add‑on, and followed with a full shutdown notice 80 minutes later. No patches had been released by 09:00 UTC, though developer Ben Arc said fixes would be merged within 24‑48 hours. LNbits also disabled its own cloud service, promising restoration by 17:20 UTC. The breach left users unable to access funds pending a fix until the security updates are deployed.

💡 The incident proves that even lightweight, community‑maintained wallet stacks can become lucrative targets, forcing operators to treat open‑source code with the same rigor as commercial services.

thehackernews.com · Nov 6

Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services

Blockchain analytics firm Chainalysis disclosed that a sophisticated agentic cyber‑attack uncovered the names, usernames, password hashes and live tokens of every user on its platform. While the breach prompted the immediate shutdown of its Reactor, Data Solutions, Know‑Your‑Transaction (KYT) UI, API and address‑screening services, the company said no evidence shows that investigation data or attribution records were accessed or altered. Chainalysis has locked affected accounts, halted password resets and is requiring users to reset passwords and rotate API keys once trusted IPs are added to an allowlist. The incident follows a prior multi‑front attack that revealed a subset of passwords and mirrors a wave of AI‑driven assaults targeting tech firms, including the use of autonomous tools like ARTEX to harvest secrets from public code repositories.

💡 The breach exposes the entire credential base of a leading crypto‑forensics provider, forcing a rare full‑service outage and compelling customers to overhaul authentication across their own systems.

thehackernews.com · Nov 1

FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The FBI announced that the North Korean‑aligned hacking collective known as TraderTraitor, also identified as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, stole more than $6.43 billion in cryptocurrency across 11 blockchains. investigators from the FBI, U.S. Secret Service and IRS‑CI said the group primarily converted the loot into Ethereum before moving it through decentralized‑finance swaps and instant‑swap services for further laundering. Binance resumed phase‑one withdrawals after pausing them following the breach, noting that deposits remain unaffected. The theft surpasses the $1.46 billion Bybit hack and represents the largest crypto heist on record, with 82 % of the stolen value on Ethereum and Bitcoin. On‑chain analysis shows $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum and Optimism.

💡 The haul demonstrates how state‑backed actors can weaponize decentralized finance to fund illicit programs, forcing regulators and exchanges to tighten cross‑chain monitoring. It also proves that even leading platforms like Binance can be disrupted by sophisticated supply‑chain attacks, reshaping risk assessments for the broader Web3 ecosystem.

thequantuminsider.com · Oct 29

Zumo and Quantum Chain Partner on Quantum-Resilient Finance

Zumo and Quantum Chain signed a memorandum of understanding to develop quantum‑resilient infrastructure for the UK’s digital asset and blockchain finance sector. The partnership will test quantum‑safe solutions across private networks, tokenised deposits, payments, and institutional digital assets, including a potential quantum‑resistant GBP stablecoin. Both firms aim to provide cryptographic agility and post‑quantum security as the National Cyber Security Centre urges a full migration to post‑quantum cryptography by 2035, amid rising fears of cryptographically relevant quantum computers.

💡 By proactively building quantum‑safe infrastructure, the collaboration addresses the imminent threat of quantum computers that could break current public‑key systems, protecting the integrity of the UK’s growing digital finance ecosystem.

thequantuminsider.com · Oct 20

Guest Post: Why Tokenised Assets Need Quantum-Ready Security

Tokenisation is moving from concept to implementation on Wall Street, with banks and asset managers testing blockchain‑based issuance, settlement and administration of assets. Ludovico Rossi of Brickken argues the technology’s potential is nascent, but it promises reduced administrative costs, faster settlement and simpler compliance. At the time, quantum computing threatens the public‑key cryptography that underpins blockchain signatures. A Google Quantum AI whitepaper predicts a machine with under 500,000 physical qubits could break elliptic‑curve signatures in minutes, exposing keys and control mechanisms for tokenised securities that may exist for decades. Rossi expects institutions to adopt “cryptographic agility,” updating algorithms as standards evolve, and cites the G7 post‑quantum roadmap and NIST draft to ban ECDSA after 2035 as signals of industry migration.

💡 Long‑lived tokenised assets could become insecure overnight if cryptography isn’t upgraded, forcing financial firms to redesign custody and compliance frameworks before quantum threats materialise.

thequantuminsider.com · Oct 16

Quantum Alliance Launches to Set Post-Quantum Standards for Blockchains

Nine major blockchain firms announced the Quantum Alliance, an open‑standards body aimed at defining and verifying post‑quantum readiness for networks, wallets, and infrastructure. The Alliance will publish testing criteria, benchmarks, and migration guidance covering transaction signatures, key management, consensus, zero‑knowledge proofs, and peer‑to‑peer links. Initial focus areas include blockchain migration, post‑quantum zero‑knowledge systems, wallet security, and cross‑chain compatibility. The initiative responds to growing evidence that quantum computers could compromise elliptic‑curve signatures by 2028‑2029, threatening the $2.9 trillion crypto market.

💡 By establishing a shared framework for quantum resistance, the Alliance forces the industry to move beyond vague claims and adopt measurable safeguards, potentially averting a future where a single quantum breakthrough could seize millions of crypto assets.