Summary Points
- A Web3Auth security flaw exposed private keys for some Keplr wallets created with Google or Apple sign-in.
- Keplr paused social sign-ins; recovery-phrase and hardware-wallet accounts are not affected.
- Some funds were moved into recovery wallets for safekeeping—not necessarily stolen. Over $6 million was transferred; the confirmed loss total remains unclear.
- Affected users should stop funding or recreating accounts, move accessible funds to a phrase- or hardware-backed wallet, and trust only official updates.
Web3Auth Flaw Exposes Some Keplr Wallets; Provider Moves Funds to Safety
Login Flaw Triggers Wallet Transfers
A security flaw at Web3Auth exposed some Keplr crypto wallets created through Google or Apple sign-in. Keplr says attackers accessed private keys—the secret codes that authorize transactions—and stole funds from some accounts.
However, an empty wallet does not always mean an attacker took the money. Web3Auth says it moved funds from other at-risk wallets into recovery wallets, working with Keplr to protect them. The companies say they plan to return those funds, but have not explained when or how.
Bitquery tracked at least $6.01 million transferred from more than 44,000 wallets. It later corrected its analysis to classify those transfers as rescues, though it could not verify who controls the recovery wallets. Separately, security firm GoPlus estimated that attackers stole at least $1 million. The companies have not confirmed a total loss.
Keplr co-founder Josh Lee estimated that about 20% of Google- and Apple-linked accounts faced the risk, with only some apparently exploited. Wallets created with a recovery phrase or hardware device remain unaffected, Keplr says. The company has paused Google and Apple sign-ins while it investigates.
What Users Should Do
Keplr advises affected users not to add funds or recreate their accounts. Instead, users should move any unlocked funds to a wallet protected by a recovery phrase or hardware device. Staked and locked assets may take longer to secure.
Meanwhile, users should follow updates only through official Keplr and Web3Auth channels. They should ignore direct messages or links promising recovery. Web3Auth has published a list of its recovery addresses, but warns users not to assume every unfamiliar address belongs to an attacker.
The flaw may also affect services Web3Auth provides to other companies, though it has named no other affected provider. MetaMask’s parent company says Web3Auth’s initial review found no evidence that MetaMask users were affected.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
DataProtection-V1
