Web3Auth login flaw exploited to drain Keplr wallets created with Google or Apple sign-in
Keplr wallets created with Google or Apple sign-in were drained after an attacker used a security flaw in the infrastructure of Web3Auth, the provider that runs that login. Both companies said the flaw led to a private key breach for some users, but neither has explained how the flaw worked, when the attacker first used it, or whether the route is closed. Keplr's co-founder estimated that about 20% of Google and Apple login accounts were affected, with only a fraction exploited. GoPlus reported at least about $1 million stolen, without explaining how it reached that figure. Web3Auth used the same route to move funds from other at-risk wallets into its own secure recovery wallets before the attacker reached them, and Bitquery counted at least $6.01 million moved from more than 44,000 wallets. Wallets protected by a recovery phrase or a hardware wallet are not affected, and Google and Apple sign-in is paused.
Detalhes técnicos
The article attributes the issue to a security flaw in Web3Auth's own infrastructure, affecting certain wallets it provides inside the Keplr app. The attacker's first transfer came 21 minutes before Web3Auth's first public notice, according to Bitquery data, and 86% of the emptied wallets were drained after the wallet maker's warning. The rescued funds went into recovery wallets on 11 Cosmos-family chains and eight Ethereum-style chains. Web3Auth paused its embedded wallet service, which other apps use, and its status page still shows the login service as down. The article says the issue affects services used by other companies, but only Keplr is named. Consensys, which bought Web3Auth in June 2025, said its initial investigation found no evidence that MetaMask users are impacted. The vendor advisories, repositories and fix were not consulted for this record, so the flaw details and affected versions are not confirmed beyond the article.
Remediação
- Do not send new funds to Google- or Apple-login accounts on Keplr.
- Do not re-import or recreate the account anywhere.
- Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
- Trust updates only from the official accounts of the wallet maker and the login provider, and ignore direct messages or links offering “recovery.”
- Do not assume an unfamiliar destination address is linked to the attacker. Use the login provider's published recovery address list to recognise its own transfers.
Relatos divergentes
- GoPlus says at least about $1 million was stolen, without a stated method (per the article).
- Bitquery counted at least $6.01 million moving into recovery wallets. It first reported these transfers as theft and has since issued a corrected analysis treating them as a rescue, while stating it cannot verify who controls the recovery wallets (per the article).
- Web3Auth says the moved funds are safe and that it is working to return them, but has not said how or when.
Linha do tempo
-
Web3Auth login flaw exploited to drain Keplr wallets created with Google or Apple sign-in
ler a análise desta fonte ocultar
Keplr wallets created with Google or Apple sign-in were drained after an attacker used a security flaw in the infrastructure of Web3Auth, the provider that runs that login. Both companies said the flaw led to a private key breach for some users, but neither has explained how the flaw worked, when the attacker first used it, or whether the route is closed. Keplr's co-founder estimated that about 20% of Google and Apple login accounts were affected, with only a fraction exploited. GoPlus reported at least about $1 million stolen, without explaining how it reached that figure. Web3Auth used the same route to move funds from other at-risk wallets into its own secure recovery wallets before the attacker reached them, and Bitquery counted at least $6.01 million moved from more than 44,000 wallets. Wallets protected by a recovery phrase or a hardware wallet are not affected, and Google and Apple sign-in is paused.
Technical Details
The article attributes the issue to a security flaw in Web3Auth's own infrastructure, affecting certain wallets it provides inside the Keplr app. The attacker's first transfer came 21 minutes before Web3Auth's first public notice, according to Bitquery data, and 86% of the emptied wallets were drained after the wallet maker's warning. The rescued funds went into recovery wallets on 11 Cosmos-family chains and eight Ethereum-style chains. Web3Auth paused its embedded wallet service, which other apps use, and its status page still shows the login service as down. The article says the issue affects services used by other companies, but only Keplr is named. Consensys, which bought Web3Auth in June 2025, said its initial investigation found no evidence that MetaMask users are impacted. The vendor advisories, repositories and fix were not consulted for this record, so the flaw details and affected versions are not confirmed beyond the article.
Remediation
- Do not send new funds to Google- or Apple-login accounts on Keplr.
- Do not re-import or recreate the account anywhere.
- Move any funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
- Trust updates only from the official accounts of the wallet maker and the login provider, and ignore direct messages or links offering “recovery.”
- Do not assume an unfamiliar destination address is linked to the attacker. Use the login provider's published recovery address list to recognise its own transfers.
Conflicting Reports
- GoPlus says at least about $1 million was stolen, without a stated method (per the article).
- Bitquery counted at least $6.01 million moving into recovery wallets. It first reported these transfers as theft and has since issued a corrected analysis treating them as a rescue, while stating it cannot verify who controls the recovery wallets (per the article).
- Web3Auth says the moved funds are safe and that it is working to return them, but has not said how or when.