A vulnerability in the social-login system used by the Keplr crypto wallet led its authentication provider, Web3Auth, to take emergency custody of user funds tied to potentially exposed private keys.
Web3Auth said the issue affected some Keplr wallets created through Google or Apple sign-in. To limit losses, it transferred assets from vulnerable wallets into 12 recovery addresses that held about $5.6 million at the time, according to the report.
Issue traced to external login provider
The flaw was attributed to Web3Auth, the third-party provider behind Keplr’s Google and Apple login flow, rather than to the Keplr wallet software itself. According to Keplr’s co-founder, roughly 20% of accounts using those social sign-in methods were affected.
Wallets secured with a seed phrase or a hardware wallet were not impacted. The exposure involved private keys for some users who had set up Keplr through the affected social-login options.
Recovery transfers caused confusion
In response, Web3Auth moved assets out of vulnerable wallets and into recovery addresses under its control. Those emergency transactions were initially mistaken by some observers for theft by an attacker.
Earlier estimates had suggested that around $6 million might have been stolen from more than 44,000 Keplr wallets. However, the report said all eight addresses associated with the attacker were among the recovery addresses used by Web3Auth, indicating that at least some of the suspicious movements were part of the protection effort rather than a separate drain.
Most funds were held on Cosmos Hub
As of that day, approximately $5.6 million in crypto assets had been collected across 12 recovery addresses. Most of the recovered funds were reported to be on the Cosmos Hub network.
Web3Auth’s recovery wallets were said to contain about 2.49 million ATOM, with an estimated value of roughly $3.3 million. Even so, the exact amount actually stolen, if any, and the final number of affected wallets had not been confirmed.
What Keplr told affected users to do next
Keplr advised users who access their wallets through Google or Apple login not to add more funds to their existing wallets. It also told them to move any remaining assets into newly created wallets protected by a seed phrase or a hardware device.
The company added that some users who noticed lower balances or missing assets may have been seeing Web3Auth’s emergency recovery transfers rather than unauthorized theft. The next confirmed step was user migration away from the affected social-login wallets while the scope of the incident remained under review.
Source: en.bloomingbit.io