Science & Tech · Cybersecurity · 7 hrs ago
Web3Auth flaw exposes some Keplr wallets created with Google or Apple
An attacker exploited a Web3Auth flaw to reach some Keplr crypto wallets created using Google or Apple sign-in.
Web3Auth provides the sign-in service used by Keplr, and Keplr says the flaw exposed private keys, which authorize wallet payments.
Some affected users lost funds, but companies have not given a confirmed total for the theft; GoPlus estimated at least about $1 million was stolen.
Web3Auth moved other at-risk funds into recovery wallets with help from Keplr, so an empty balance may mean money was moved for safekeeping rather than stolen.
Blockchain data firm Bitquery counted at least $6.01 million transferred from more than 44,000 wallets, but said it could not verify who controls the recovery wallets.
Keplr has paused Google and Apple sign-in while it investigates, and the companies are working on a way for users to check whether their accounts were affected.
Users with those accounts are advised not to add funds or recreate them, and to move accessible funds to a wallet secured by a recovery phrase or hardware device.
An attacker exploited a Web3Auth security flaw to access some Keplr wallets created using Google or Apple sign-in, and some users lost money.
Web3Auth and Keplr moved funds from other at-risk wallets into recovery wallets to protect them.
Keplr said wallets created with a recovery phrase or hardware wallet were not affected.
Keplr has paused Google and Apple sign-in and advised affected users not to add funds or recreate their accounts.
The companies have not said how the flaw worked or when the attacker first used it.
- Who
- Users of Keplr wallets created with Google or Apple sign-in, and an attacker who exploited a Web3Auth flaw.
- What
- Some funds were stolen; other at-risk funds were moved into recovery wallets for safekeeping.
- When
- The companies disclosed the issue late last week. The attacker’s first use of the flaw was not stated.
- Where
- In wallets provided inside the Keplr app, across blockchains in the Cosmos family and Ethereum-style chains.
- Why
- A security issue in Web3Auth’s infrastructure allowed access to some wallets.
This story does not have two clearly opposing sides.
Web3Auth and Keplr disclosed that a security issue had affected some Keplr wallets using Google or Apple sign-in.
The first transfers into recovery wallets took place, according to Bitquery’s data.
Most of the wallets whose funds were moved had been emptied, according to Bitquery.
- Affected sign-in methods
- Google and Apple
- Affected wallet type
- Some Keplr wallets provided through Web3Auth
- Recovery destinations
- 11 Cosmos-family blockchains and eight Ethereum-style chains
- Funds moved
- At least $6.01 million from more than 44,000 wallets, according to Bitquery
- Estimated theft
- At least about $1 million, according to GoPlus
- Affected accounts
- About 20% of Google and Apple login accounts, with only a fraction apparently exploited, according to Keplr co-founder Josh Lee
What people are saying
private key breach
Posts on X
What this means for Keplr users If you created your Keplr wallet with a recovery phrase or a hardware wallet, you are NOT affected. In response to Web3Auth’s infrastructure vulnerability leading to private key breach some Keplr users who signed in with Google or Apple, we are
Update on Keplr asset recovery: As part of our ongoing response to the security incident affecting certain Keplr wallets, we have been transferring assets into secure recovery wallets, with assistance from Keplr. 🧵
Initial findings and some clarifications on the Google/Apple login incident. First, to those affected: I'm sorry, and we're doing everything we can. 1. This was not a hack of Keplr's code. The incident originated at Web3Auth, a provider Keplr uses. All other Keplr accounts,