This afternoon, Keplr, a wallet in the Cosmos ecosystem, posted an announcement. Some wallets created by signing in with a Google or Apple account have seen transfers that users did not authorize. Keplr has paused both Google and Apple sign-in while it investigates the cause with Web3Auth, the provider of its login technology. Web3Auth has also acknowledged the issue. Just after 11 p.m. last night, it issued a statement saying its service had a security issue and that its embedded wallet service had been suspended.

The problem is with the login process, not the wallet itself. Web3Auth lets you create a wallet using your Google or Apple account without writing down a recovery phrase. It’s convenient, but it means your wallet keys are effectively held by this intermediary layer. If something goes wrong there, your money can be transferred without you confirming it. Keplr’s Josh Lee preliminarily estimates that about 20% of accounts using Google or Apple sign-in were affected. Of those, only some actually had money transferred out; the rest may still be recoverable. These are only preliminary estimates. The team has yet to disclose how many people were affected or how much money was lost.

How do everyday users get caught out? Basically, there’s one way: you take the easy route and create a wallet using your Google account. Using it day to day feels no different from logging into a regular app. But by the time you check your transaction history after something goes wrong, the money is already gone. Worse, with this kind of wallet, you don’t even have a recovery phrase. You can’t move your money somewhere safe yourself—you have to wait for the official team to explain what’s going on first.

There are three things you can do right away. First, if you created your Keplr wallet using your Google or Apple account, don’t transfer money into it or import it into another service for now. Wait for an official update. Second, check the other wallets and apps on your phone. If you weren’t asked to write down a recovery phrase when you created a wallet and instead logged in with one tap using your Google or Apple account, treat it as a social-login wallet, whatever it’s called: don’t add new funds, and wait for an official update. Third, use this as a chance to think things through. For wallets where you keep your money, manage the keys yourself using a recovery phrase or a hardware wallet. Use convenient login methods only for small amounts, so if something goes wrong, it won’t hit you too hard.

One more reminder: after an incident, fake account-recovery messages and links claiming to be from the official team will start appearing right away. Keplr has warned about this too. Don’t trust anything that asks you to click a link to recover your account or enter your recovery phrase. Only trust messages from official channels.

In this incident, preliminary investigations found that MetaMask users were unaffected, and Keplr accounts using a recovery phrase or hardware wallet were also unaffected. That said, until the specific cause is announced, treat accounts using social login as potentially at risk.

Does your current wallet use a recovery phrase that you control, or did you create it by logging in with one tap using your Google or Apple account?

#Keplr #Web3Auth #钱包安全 #社群登录 #ScamAlert

—— Xiao Kai, Web3 Crypto Degens

Disclaimer: These are personal opinions and do not constitute investment advice. Crypto carries extremely high risk; only invest money you can afford to lose. Sources: The Defiant, PANews, KuCoin Flash News, and ChainCatcher. Figures reflect the values available at the time of publication.