Jury crypted

Web3Auth pauses embedded wallet service after security issue, Keplr users hit MetaMask users appear unaffected, but Cosmos wallet Keplr disabled social logins after unauthorized transactions surfaced Web3Auth, the embedded wallet provider now folded into MetaMask under Consensys, has temporarily paused its embedded wallet service after identifying a critical security issue. The company says there is no evidence MetaMask users were affected. The same cannot be said for everyone who built on top of its infrastructure. The pause took effect on November 6, 2026, at approximately 21:13 UTC. Web3Auth said it shut things down to investigate the possible impact of the issue. The fallout landed hardest on third-party integrators. Chief among them was Keplr Wallet, a popular wallet in the Cosmos ecosystem. How the incident spread to Keplr Keplr used Web3Auth to power social logins, letting users sign in with Google and Apple accounts instead of managing a seed phrase. Keplr reported unauthorized transactions beginning around November 6, the same date Web3Auth flagged its issue. After tracing the problem back to Web3Auth, Keplr disabled its Google and Apple login options on November 7 to limit further risk. The exposure was not universal across Keplr’s user base. Roughly 20% of Keplr users who relied on social logins could have been exposed, according to figures tied to the incident. Blockchain tracking data linked to the breach shows around $6 million in outflows. Those funds moved from more than 44,000 Cosmos addresses and about 7,600 Injective addresses. Web3Auth has contested that total loss figure. So the $6 million number should be read as an estimate drawn from onchain flows, not a confirmed tally of stolen funds. The company has also started recovery measures. These include so-called white-hat transfers, which move assets out of vulnerable wallets and into verified addresses before an attacker can get to them. Not everyone was caught in the blast radius. Trust Wallet and standard MetaMask accounts were found to be unaffected. Keplr accounts that did not use social login also remained untouched. Why social-login wallets are under the microscope Embedded wallets with social login exist to solve one of crypto’s oldest usability headaches: the seed phrase. Social login lets users sign in the way they would with any app. Behind the scenes, a third party handles much of the key management so the user never has to. Many of these setups rely on multi-party computation, or MPC. In plain terms, MPC splits control of a private key across multiple parties, so no single piece is enough on its own to move funds. On paper, that spreads risk around. In practice, this incident shows the arrangement also adds a dependency: if the provider handling part of the process has a flaw, every app built on it may inherit that flaw. What this means for wallets, users and builders For builders, the incident raises a hard question about concentration risk. When many wallets plug into the same embedded wallet provider, a single issue can ripple across multiple ecosystems at once, in this case reaching both Cosmos and Injective users through one integration. Keplr’s quick move to disable social logins was effectively the emergency brake. For MetaMask and Consensys, the reassurance that MetaMask users show no sign of compromise will matter a great deal to that plan. Several open questions remain worth watching. The first is the final accounting: whether Web3Auth’s dispute of the $6 million figure results in a materially different number. The second is how much of the exposed value the white-hat transfers manage to secure. The third is when, and under what conditions, Web3Auth restores its embedded wallet service and Keplr turns social logins back on. Get more instant news on cexaid.com/news

Cosmos Batch Moves 2,266 Staked ATOM From Six Accounts One delegator reported theft, while Web3Auth says some apparent wallet drains are protective recovery transfers. A Nov. 7 Cosmos Hub transaction converted 2,265.59 staked ATOM from six accounts into transferable staking claims and sent those tokens to one address, according to The Defiant’s analysis of onchain records. The movement prompted a theft report from one delegator, but its purpose is unresolved. Web3Auth says it and its partners are conducting whitehat recovery operations following a security incident affecting Keplr wallets. The company has warned that some recovery transfers have been mistaken for attacker activity. A Cosmos forum user posting as Stan identified one of the six accounts as his and said 356.009956 ATOM had been tokenized without his approval. “I never signed this transaction and never granted authz permissions to anyone,” he wrote in his report. The transaction contains the account and amount he identified. How the Batch Moved Staked ATOM The successful transaction was recorded at 5:18 a.m. ET on Nov. 7. Its 27 messages comprised a tiny self-transfer, six staking-reward withdrawal-address changes, 10 stake-tokenization operations and 10 transfers of the resulting share tokens. All six withdrawal addresses and all 10 tokenization-record owners were set to the same recipient. The memo read “lsm recovery batch,” which does not itself establish who operated it. The Hub’s liquid staking module, or LSM, converts a delegation into transferable tokens representing a claim on staked ATOM. That lets ownership change without waiting through the normal 21-day unbonding period. The underlying ATOM remains bonded; redeeming the tokens restores an ordinary staking delegation rather than releasing immediately spendable ATOM. The batch carried seven direct-mode signatures: one for the fee-paying account and one for each delegator. It used those signatures rather than an authz execution wrapper to carry out the batch. The signer set explains how the batch acted for multiple accounts, but does not establish who controlled their keys or whether their owners approved it. A subsequent balance query showed that the destination still held the full share-token amount sent from the account Stan identified. Breach and Recovery Web3Auth disclosed a security issue on Nov. 6 and paused its embedded-wallet service. Keplr later described a Web3Auth infrastructure vulnerability that exposed private keys for some users who signed in with Google or Apple. Keplr said its assistance with recovery efforts means some social-login accounts may show reduced or empty balances. Whether the six accounts in this batch were affected by that breach, and whether their recipient is an attacker or a recovery operator, remains unconfirmed. In its Nov. 7 guidance, Keplr told Google- and Apple-login users not to send new funds to those accounts and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. It said wallets created with a recovery phrase or hardware wallet were not affected.

SMCI Price Prediction: Price holds above pivot as analysts split on the underlying shares What changed in the market setup SMCI’s futures market is still trading below its short- and medium-term trend measures, even after a modest 1.44% daily gain to $28.84. That price sits just above the pivot point at $28.75, but it remains under the 7-day SMA at $30.35, the 20-day SMA at $32.63, the 50-day SMA at $37.42, the 12-day EMA at $31.10 and the 26-day EMA at $33.30. In other words, the recent bounce has improved the short-term tone, but it has not yet changed the broader structure. Momentum readings lean cautious rather than constructive. The daily RSI of 37.95 is still in the neutral-to-soft zone, while MACD is negative at -2.2043 and the histogram is flat at 0.0000. Stochastic readings, with %K at 28.74 and %D at 22.99, suggest the instrument is still trading near the lower part of its recent range instead of showing a confirmed rebound. How the current levels fit together The most important nearby levels are clustered tightly around the current price. Immediate support is $27.96, followed by stronger support at $27.09. On the upside, immediate resistance is $29.62 and stronger resistance is $30.41. That structure is consistent with the Bollinger Bands data. The lower band is $27.67, the middle band is $32.63 and the upper band is $37.59, with %B at 0.1169. That places price near the lower band, which supports the view that the market is still testing support rather than building a range above the middle band. The ATR(14) of $2.30 also suggests the instrument can move through these levels quickly once price leaves the current band. What derivatives positioning does and does not say Binance futures data shows neutral funding at 0.0000%, so there is no current settlement bias forcing longs or shorts to pay. Open interest stands at 210,337.36 contracts, with an open interest value of $5,582,075, and it fell 8.03% over 24 hours. That decline points more to position reduction or liquidations than to fresh aggressive exposure. The long/short ratios lean long inside Binance cohorts, but the reading is mixed rather than one-directional. Global accounts show 57.5% long and 42.5% short at an observation time of 2026-11-07 10:00:00 UTC, while top-trader accounts show 66.1% long and 33.9% short at the same observation time. Taker flow is only slightly buy-heavy, with a 1.0550 buy/sell ratio based on 626 buy volume versus 594 sell volume. Taken together, that is supportive of demand, but not strong enough on its own to override the still-bearish trend signals from price and momentum. The analyst updates apply to the underlying shares, not the futures instrument The latest analyst updates concern Super Micro Computer’s underlying NASDAQ-listed shares, and both were dated November 4, 2026. Raymond James, reported by Stocktwits citing TheFly, raised its price target from $48 to $65 and maintained an Outperform rating, while noting the latest results and higher full-year forecast as positives and flagging gross-margin pressure and customer concentration. Bank of America, reported by MarketBeat citing Benzinga, raised its target from $38 to $39 and maintained an Underperform rating. These are separate from the Binance futures pricing and technical data. They may frame expectations for the equity, but they do not change the intraday structure of the SMCI futures-linked instrument on their own. The split also shows that the analyst range remains wide, with the two firms drawing different conclusions from the same business update. Levels that matter from here For the current futures-linked setup, a move through $29.62 would be the first sign that price is trying to reclaim short-term resistance. If that happens, $30.41 becomes the next test and the first level that would begin to challenge the negative trend structure. Scenario; Direction: long; Entry: $28.84; Stop: $27.96; Target: $29.62; Reward/risk: 0.89:1 (before fees, slippage and gaps). Scenario; Direction: long; Entry: $28.84; Stop: $27.96; Target: $30.41; Reward/risk: 1.78:1 (before fees, slippage and gaps). If $27.96 fails instead, the next downside reference is the lower Bollinger Band at $27.67, followed by stronger support at $27.09. For now, the evidence still points to a market that is trying to stabilize, but has not yet cleared the trend damage that built up before this rebound.

BNB Chain, Base respond to Reth security bug affecting EVM networks In a November 6 notice, BNB Chain acknowledged the security risk affecting Reth but said its opBNB network does not use op-reth, while the impact on BSC-Reth remains limited. The team said it was preparing a hotfix and closely monitoring the situation to protect network security. Developers and users were told that no action was required at the time of the announcement. Base, meanwhile, confirmed that it had resolved the issue on November 5, after identifying the vulnerability a day earlier. The Coinbase-backed layer 2 network said its operations were not disrupted and user funds were unaffected. The problem concerns how certain versions of Reth calculate a blockchain’s state root, a cryptographic value representing the current state of accounts, balances, and smart contract storage. An incorrect calculation could cause affected nodes to disagree with the network’s actual state, potentially interrupting synchronization or producing unreliable state proofs used by applications. Base releases patch after confirming blockchain state According to an official status update, Base discovered on November 4 that the Reth bug could cause nodes to calculate an incorrect state root under certain conditions. Because Base uses Reth as part of its execution infrastructure, its developers applied the mitigation and patched all block-building nodes on the same day. The team subsequently recalculated the network’s state root and confirmed that it matched the correct value. Base explained that its proof system independently verifies every state root, providing another mechanism for detecting inconsistencies in blockchain calculations. “We’ve verified the current state root is correct and users were not affected,” the team said. A software update, version 1.5.3, was released to prevent Base validators from halting when encountering invalid state roots. Node operators were advised to install the update as soon as possible, although Base said they would not need to resynchronize their nodes or perform additional recovery procedures. The network’s November 5 status notice listed a maintenance window running until November 7 at 16:19 UTC, while the public patch became available at 17:52 UTC on November 5. Reth developers fix state root calculation bug The underlying issue originated in Reth, an Ethereum execution client developed by Paradigm that is used directly or through modified versions across several blockchain networks. A GitHub change merged on November 3 addressed an error involving how the client’s trie iterator handles certain cached branch boundaries. The fix changed the iterator’s behavior when searching through stored blockchain data and introduced a regression test covering incremental state root calculations. Reth developers subsequently included the correction in version 2.10.0, while patched versions of related software included op-reth 2.8.1 and Base’s 1.5.3 release. Blockchain security firm Blockaid warned that unpatched clients could experience synchronization problems or return incorrect proofs through the eth_getProof interface. The firm described the problem as a software correctness bug rather than a confirmed exploit and reported no known financial losses associated with the flaw. The vulnerability prompted responses from networks using Reth-based infrastructure, although their exposure depended on the specific client implementations deployed. BNB Chain’s announcement distinguished between opBNB, which does not rely on op-reth, and BSC-Reth, where the team acknowledged limited exposure while preparing its own fix. LayerZero pauses some cross-chain services as precaution The Reth issue prompted precautionary restrictions beyond the affected execution clients, particularly among services that rely on blockchain state verification. Cross-chain interoperability provider LayerZero temporarily suspended some off-chain infrastructure connected to affected networks while software fixes were being deployed. The restrictions delayed certain cross-chain messages, although reports citing the security response said the messages would not be lost. Some decentralized finance services temporarily restricted deposits or cross-chain routing as operators assessed their exposure. LayerZero provides interoperability infrastructure used by numerous blockchain applications. In September, Anchorage Digital selected LayerZero to support cross-chain transfers for stablecoins issued through its federally chartered bank. The partnership named Tether’s USAT as the first stablecoin to use LayerZero’s Omnichain Fungible Token standard under the arrangement. Separately, ApeChain announced plans on November 4 to migrate APE, USDC, and other ecosystem assets from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol. The migration announcement preceded the public warnings about the Reth vulnerability and concerned ApeChain’s existing cross-chain infrastructure. For operators running affected Reth-based software, the available updates address the state calculation problem, with Base specifically recommending version 1.5.3 and BNB Chain continuing work on its BSC-Reth hotfix.