Keplr Says Web3Auth Flaw Led to Private-Key Breach; Funds Moved to Recovery Wallets
Summary
Keplr says a Web3Auth infrastructure flaw exposed private keys for some Google- and Apple-login wallets. Web3Auth moved funds to recovery wallets; theft totals remain unclear, and the companies have not explained the flaw or restoration timeline.
Key points
- Keplr says a Web3Auth infrastructure flaw led to a private-key breach for some wallets created with Google or Apple sign-in; the companies have not explained how the flaw worked or when it was exploited.
- Web3Auth says it moved funds from at-risk wallets into recovery wallets across 11 Cosmos-family and eight Ethereum-style chains; an empty balance may therefore reflect a rescue transfer rather than theft.
- Keplr says wallets created with a recovery phrase or hardware wallet are unaffected, and it has paused Google and Apple sign-in while investigating.
- The wallet maker says staked and locked assets are taking longer to secure and is working on a way for users to check whether their accounts were affected. Web3Auth published a recovery-address list and warned that an unfamiliar destination is not necessarily attacker-controlled.
- Keplr co-founder Josh Lee initially estimated about 20% of social-login accounts were affected, with only a fraction apparently exploited. GoPlus estimated at least $1 million stolen but did not explain its calculation.
- Bitquery counted at least $6.01 million moving from more than 44,000 wallets to recovery wallets, then corrected its analysis to treat the transfers as rescues; it said it could not verify who controls those wallets.
Article Details
- Victim Organization
- Keplr
- Incident Type
- Exploitation of a security flaw in Web3Auth infrastructure led to a private-key breach affecting some Keplr wallets created with Google or Apple sign-in, and theft from some wallets.
- Data Types Exposed
- Private keys
- Affected Records
- Josh Lee, a Keplr co-founder, estimated that about 20% of Google- and Apple-login accounts were affected, with only a fraction of those appearing to have been exploited. No total account count was provided.
- Operational Impact
- Some users' funds were reportedly stolen. Web3Auth and Keplr moved funds from at-risk wallets into recovery wallets for safekeeping; Bitquery counted at least $6.01 million moved from more than 44,000 wallets and later corrected its analysis to classify the transfers as rescue activity. Keplr paused Google and Apple sign-in while investigating, and Web3Auth paused its embedded wallet service.
- Claim Status
- confirmed