Title: A Web3Auth Flaw Let an Attacker Reach Keplr Wallets Built on Google or Apple Sign-in
Summary: Some users who set up a Keplr crypto wallet with a Google or Apple account have had money stolen by an attacker; Keplr calls it a “private key breach” for those users, the two companies having confirmed the incident. Since late last week, Web3Auth — the login service running Keplr’s social sign-in, part of MetaMask’s parent Consensys since 2025 — has been sweeping other at-risk wallets through the same path the attacker used, reaching them first and parking the funds in recovery wallets pending return. Blockchain analyst Bitquery counted at least $6.01 million in what Web3Auth lists as its recovery wallets, coming from at least 44,041 Keplr social-login wallets across seven Cosmos chains and 7,603 more on Injective; the first sweeps landed 21 minutes before Web3Auth’s first public notice, and 86% of the wallets were swept after Keplr already warned its users at 04:38 UTC on November 7. How much the original attacker got remains unknown: neither company has named the attacker’s addresses or a theft total (security firm GoPlus put it at about $1 million), so an empty social-login balance may mean funds were rescued rather than stolen. Wallets created with a recovery phrase or a hardware wallet are unaffected. Keplr has paused Google and Apple sign-in while the incident is investigated, and Web3Auth has separately paused its embedded wallet service. Keplr’s guidance for affected accounts: send no new funds to it, don’t re-import or recreate it anywhere, move any funds that aren’t staked or locked to an account using a recovery phrase or hardware wallet, and only trust updates from Keplr’s and Web3Auth’s own channels — beware of “recovery” offers. Web3Auth has published a list of recovery addresses so people can tell its transfers apart from malicious ones. As of posting, its status page still shows the Login Service with an ongoing outage.
References: