Web3Auth flaw exposes some Keplr users’ crypto wallets

Keplr’s wallet service, which uses Web3Auth for Google and Apple sign-ins, disclosed a security flaw in Web3Auth that allowed an attacker to access certain wallets created via Google or Apple sign-in. Keplr and Web3Auth described the flaw as a “private key breach” for some sign-in users, though neither firm has explained exactly how the vulnerability worked or when it was first exploited. Keplr has paused Google and Apple sign-ins while the investigation continues.

Evidence and impact so far point to a broad, but not universal, effect. Keplr co-founder Josh Lee estimated that around 20% of Google and Apple login accounts were affected, with only a fraction appearing to be exploited. GoPlus’s security alert put the initial theft figure at about $1 million, though it later did not detail how that amount was calculated.

Blockchain analytics firm Bitquery counted at least $6.01 million moving from more than 44,000 wallets into “secure recovery wallets” across 11 Cosmos-family chains and eight Ethereum-like chains; it later reframed the transfers as rescue activity rather than theft. The first transfers occurred 21 minutes before Web3Auth’s initial public notice.

The wallet maker says rescued funds are being returned to users in partnership with Web3Auth, and says wallets created with recovery phrases or hardware wallets were not affected. Keplr says the recovery addresses list published by Web3Auth helps users distinguish legitimate transfers from potentially malicious ones, and that most affected accounts are continuing to be investigated. Consensys, the owner of Web3Auth, has noted its MetaMask users were not shown to be impacted.