Written by: Sam, Techub News
Introduction
This weekend's three events all ask the same question: How trustworthy is the layer you rely on?
The Keplr wallet created with a single click using Google or Apple accounts has its private keys hosted and generated by a third-party service, Web3Auth, which has resulted in a vulnerability; Sun Yuchen's celebrity token offering case, which was sued by the SEC three years ago, only reached a settlement of 10 million dollars this March, with a person claiming to be an intermediary back then bringing out "quotations and invoices"; NVIDIA founder Jensen Huang admitted to an extramarital affair to all employees on Sunday, and the board announced the establishment of an independent committee the same day to investigate whether he has become a target of foreign intelligence operations.
Core Summary
- Web3Auth acknowledged that security issues in its infrastructure led to the leakage of some private keys from Keplr wallets using Google and Apple logins and has suspended embedded wallet services; Keplr suspended social logins, while users of recovery phrases and hardware wallets remain unaffected.
- Web3Auth stated it proactively transferred assets "along the same path as the original attacker" and released 12 recovery addresses, with The Block estimating approximately 5.6 million dollars in them; neither side has disclosed how much was actually stolen.
- Sahil Arora stated on X that between 2021 and 2022, Sun Yuchen paid him over 4 million dollars to promote TRX and BTT through celebrities, posting what he claimed were group chat and invoice screenshots; these materials have not been independently verified, and Sun Yuchen has yet to respond.
- The NVIDIA board announced the formation of a committee composed of independent directors and hired external lawyers to conduct an independent investigation; Jensen Huang admitted to infidelity and apologized in a letter to employees, expressing support for the investigation. The board stated there is no reason to believe that national security or company secrets have been compromised and expressed trust in Huang.
1. One-click Login Wallet: The Private Key is Neither Completely in Your Hands Nor in the Service Provider's Hands
Keplr is one of the most popular wallets in the Cosmos ecosystem. Like most wallets, it offers two account opening methods: self-custody of a recovery phrase or one-click login with a Google or Apple account. The latter doesn't provide a recovery phrase, with the private key generated by Web3Auth's distributed key technology, fragmented and stored across the user's device, the login service provider, and recovery methods. The selling point is that users don't have to write down 12 words.
The issue lies with Web3Auth. On November 7 at midnight Beijing time, Web3Auth released a statement saying that it discovered security issues in some services used by third parties and has suspended embedded wallet services; initial investigations found no evidence that MetaMask users were affected. Web3Auth is currently owned by Consensys, and the product has been renamed to MetaMask Embedded Wallets. By noon that day, Keplr reported receiving reports of unauthorized transactions on some Google and Apple login accounts, suspending social logins and advising these users not to transfer money into their accounts, as users who opened accounts with recovery phrases or hardware wallets were not affected. In the afternoon, Polygon's Chief Information Security Officer Mudit Gupta directly urged on X: People who have used Google or Apple to log in to Keplr should quickly transfer their funds if possible.
In the early hours of the 8th, Web3Auth confirmed that the security issue was within its own infrastructure, affecting some embedded wallets used by Keplr. The subsequent response complicated matters further: Web3Auth stated that it, along with partners, proactively transferred wallets that had not yet been stolen but had been exposed "along the same path as the original attacker". Many users opened their wallets to find their balances decreased or even cleared, making it unclear whether they were stolen or "rescued." Keplr also warned that the decrease in balances for some accounts was indeed due to these protective measures.
On the afternoon of the 8th, Web3Auth posted recovery addresses: one each from Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga, and Agoric, plus one address covering 8 EVM chains. According to The Block, these 12 addresses held approximately 5.6 million dollars at that time, with the largest amount being about 2.49 million ATOM on Cosmos Hub; all 8 "hacker addresses" previously marked by on-chain data service Bitquery were included in this recovery list. Bitquery estimated that over 44,000 Keplr wallet assets were aggregated, totaling about 6 million dollars, including both stolen and transferred protective assets.
The actual amount stolen remains unanswered. Web3Auth mentioned "the original attacker," indicating that some wallets were already stolen before the white-hat operation, but did not disclose the amount; Keplr co-founder Josh Lee told The Block that about 20% of social login accounts were exposed to risk, while only a few were actually exploited. Another unanswered question is: after the exposure of private keys, how can users prove ownership of the transferred assets to recover their funds? Web3Auth and Keplr only stated they are formulating a plan.
2. Sun Yuchen's Old Token Promotion Case: After the Settlement, the Former Intermediary Starts Digging Up Old Accounts
Sahil Arora is known in the crypto space for orchestrating celebrity tokens. Early on November 8, he hinted on X that he would share the story of "Your Excellency," posting a lengthy thread that evening: Between 2021 and 2022, Sun Yuchen paid over 4 million dollars through him to have celebrities promote TRX and BTT on social media, selling the tokens in batches after each price increase. According to him, Sun Yuchen first requested a celebrity quotation and then created a workgroup including "Tron Alliance/Rainberry" and key members of Sun Yuchen's team; the team selected artists, he would issue invoices, and payments were settled in USDT on TRC20. He also posted chat records and invoice screenshots, claiming that Sun Yuchen was involved in the NFT platform FansForever, which was used for wash trading.
These claims correspond to the SEC's lawsuit from March 2023. At that time, the SEC accused Sun Yuchen and his three companies of selling TRX and BTT without registration and manipulating the secondary market for TRX through extensive wash trading, while simultaneously suing eight celebrities, including Lindsay Lohan, Jake Paul, and Akon, for promoting tokens without disclosing that they were paid. Sun Yuchen stated at the time that the accusations were baseless.
This case reached a settlement in March of this year: The Tron-affiliated company Rainberry paid a civil fine of 10 million dollars, and the SEC withdrew all charges against Sun Yuchen as well as the Tron Foundation and BitTorrent Foundation, with Sun Yuchen neither admitting nor denying the original allegations. Therefore, the content revealed by Sahil, even if true, is only details from an old case that has already been settled.
It needs to be clarified that Sahil's screenshots are currently only one-sided materials he has released and have not been independently verified; he himself was a participant in this business, and he has been naming other projects in recent days. As of the time of publication, Sun Yuchen has not publicly responded.
3. Jensen Huang: An Apology Letter and an Independent Investigation
On November 8 (Sunday U.S. time), NVIDIA's official website released two statements in succession.
One was an email from Jensen Huang to all employees. He wrote, "I have been unfaithful to my wife. My actions have hurt her and our children. There is no excuse for what I have done, and I am deeply sorry." The letter did not mention who the other party was. Regarding the national security concerns reported by the media, he stated that the board has initiated an independent investigation, stating he supports and will fully cooperate, "I love our country and our company."
The other statement came from the board: In light of recent reports that Huang is a target of foreign intelligence operations, the board initiated an independent investigation, assigning a committee composed of independent directors to be assisted by external independent lawyers; the board currently has no reason to believe that national security or NVIDIA's secrets have been compromised but will review all available information and expresses confidence in Huang and his management team.
Prior to the two statements, a week of reporting had fermented. According to TechCrunch and Tom's Hardware, U.S. intelligence agencies believe that Huang had a romantic relationship with former Megaspeed executive Alice Huang (also known as Huang Le) from Singapore, and a memo that circulated earlier this year in U.S. policy circles stated that she was recruited by the Ministry of State Security of China to get close to Huang; Megaspeed was previously accused of smuggling AI chips worth about 2 billion dollars. NVIDIA had previously responded that their interactions "are not uncommon," and the company would not share confidential information with clients. It was reported that on November 5, the chairmen of three U.S. House committees have required Huang to provide a closed-door explanation on this matter.
For the market, the importance of this matter lies in Jensen Huang himself. He is the founder and the only CEO of NVIDIA and has frequently spoken out regarding chip export issues to China. The board did not suspend him this time, and NVIDIA stated he will continue to lead the company. When the investigation will yield results and how the House's closed-door explanation will proceed are the next two things to watch; the market's reaction to NVIDIA's stock price when U.S. markets open on Monday will be the first response from the market.
References
2. Keplr Wallet: What this means for Keplr users (X, 2026-11-07)
3. Web3Auth: Statement on Suspension of Embedded Wallet Services (X, 2026-11-06)
4. Web3Auth: Confirmation of Infrastructure Security Issues (X, 2026-11-07)
5. Web3Auth: Explanation of the White Hat Recovery Action (X, 2026-11-07)
6. Web3Auth: List of Recovery Addresses (X, 2026-11-08)
7. Reminder from Mudit Gupta (X, 2026-11-07)
8. The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets
9. Sahil Arora's Long Post About Sun Yuchen (X, 2026-11-08)
10. US SEC drops Justin Sun lawsuit with $10M settlement from Rainberry (crypto.news)
11. NVIDIA: A Message to Our Company (2026-11-08)
12. NVIDIA: Statement from NVIDIA Board of Directors (2026-11-08)
13. TechCrunch: Nvidia will investigate CEO Jensen Huang's relationship with possible Chinese spy
14. Tom's Hardware: Nvidia CEO Jensen Huang admits to an affair with a suspected Chinese spy
Editor's Note: The times in this article, unless otherwise indicated, are in Beijing time. The loss amounts in the Keplr incident are based on statements from Web3Auth, Keplr, and statistics from The Block and Bitquery, with the actual amount stolen not disclosed; Sahil Arora's accusations and screenshots have not been independently verified in this article; the intelligence suspicions involving Huang are derived from media reports citing U.S. intelligence agencies and policy memos, and the NVIDIA board's investigation has yet to reach a conclusion.
Disclaimer: This article is for informational reporting and analysis only and does not constitute any investment advice.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
