Web3Auth security incident hits Keplr wallets made with Google login

Updated 7 November, 10:45 UTC. Keplr founder Josh Lee said about 20% of its social-login wallets were affected, only a fraction were drained, and the rest may be recoverable.

About one in five Keplr wallets created with Google or Apple login were affected by a security incident at Web3Auth, the provider behind that login, according to an early estimate that Keplr founder Josh Lee gave on Saturday. Lee said the incident "originated at Web3Auth" and was not a hack of Keplr's code, and that only a fraction of the affected 20% appear to have actually been exploited. The rest "may be recoverable", he wrote, and Keplr is working with the Web3Auth and MetaMask team on tracking and recovery.

Web3Auth paused its embedded wallet service at 21:13 UTC on Friday over what it called a "security issue affecting Web3Auth's services used by some third parties". About seven hours later Keplr reported unauthorised transactions on some accounts created with Google or Apple login.

Web3Auth's status page shows its Login Service in maintenance mode "due to a security incident" from 18:30 UTC on Friday, with the window set to run for a day. Web3Auth, which says it was acquired by Consensys, the company behind MetaMask, said its initial investigation found no evidence that MetaMask users are affected.

Who is affected

Keplr says that, based on its initial assessment, wallets created with a recovery phrase or a hardware wallet are not affected. Accounts created with Google or Apple login may be. It has paused Google and Apple login and tells users of those accounts:

• not to send new funds to the account;
• not to re-import or recreate it anywhere else;
• to trust updates only from Keplr's own account and ignore messages or links offering "recovery".

A social-login wallet does not give its user a recovery phrase to hold; access runs through the provider's login service, which Web3Auth describes as key management with multi-party computation.

Recovery

Asked whether accounts that have not been drained will get a way to move funds to a new recovery phrase inside Keplr, Lee replied: "Yes. More details to follow but that is the plan." Until then Keplr's advice stands: do not re-import or recreate an affected account elsewhere.

What is not known

Neither company has said how much was taken or what the security issue in Web3Auth's services is. Lee's 20% figure is an early estimate, and he has not said how many accounts that represents. Web3Auth has not named the third parties whose services were affected. Keplr is the only affected app we found that has spoken publicly.

Web3Auth says it will share confirmed details and any steps users of affected services need to take once it has them.