Keplr posted an update early this morning.
My first reaction after reading it was: no matter how convenient it is, don’t use social login as your primary wallet.
Here’s what happened.
Starting November 6, users began reporting that funds had mysteriously been transferred out of Keplr wallets created with Google / Apple login.
After looking into it, the issue turned out not to be in Keplr’s own code.
A vulnerability in the Web3Auth infrastructure behind it exposed the private keys of some social-login accounts.
A Keplr co-founder estimates that around 20% of social-login accounts were affected, and some have already been drained.
The official team still hasn’t said exactly how much was lost, so I’m not going to make up a number.
Today’s update hit a little harder.
Keplr says it’s working with Web3Auth to rescue assets.
Some affected accounts have already seen their balances drop or even hit zero because white hats moved the assets to safety.
They also made this clear: if you log in with Google / Apple, stop transferring funds into those accounts.
Move any assets you can still access to a wallet secured with a recovery phrase or to a hardware wallet as soon as possible.
Staked and locked assets are more complicated to handle, so users will have to wait.
Wallets created with a recovery phrase and hardware wallets were not affected this time.
I read that sentence twice.
Put simply, convenience comes at a cost.
Social login feels seamless, but your private key is actually held by a third party.
You think it’s your wallet, but the keys aren’t in your hands.
My own rule has always been: big money stays in a hardware wallet.
For small, everyday amounts, I only keep what I wouldn’t mind losing.
This incident was another reminder for me:
Don’t begrudge the extra hassle. In this space, hassle is the cheapest insurance 🔐
One more reminder:
There are definitely going to be a ton of DMs from people impersonating officials, claiming they can “help you recover your assets.”
Don’t believe them, and don’t click anything.
Only trust official Keplr and Web3Auth channels.
Is your primary wallet a recovery-phrase wallet or a social-login wallet?
Let’s talk in the comments.
$ATOM $OSMO
#钱包安全 #市场观察 #Cosmos
This is not investment advice. DYOR. Trading involves risk.
My first reaction after reading it was: no matter how convenient it is, don’t use social login as your primary wallet.
Here’s what happened.
Starting November 6, users began reporting that funds had mysteriously been transferred out of Keplr wallets created with Google / Apple login.
After looking into it, the issue turned out not to be in Keplr’s own code.
A vulnerability in the Web3Auth infrastructure behind it exposed the private keys of some social-login accounts.
A Keplr co-founder estimates that around 20% of social-login accounts were affected, and some have already been drained.
The official team still hasn’t said exactly how much was lost, so I’m not going to make up a number.
Today’s update hit a little harder.
Keplr says it’s working with Web3Auth to rescue assets.
Some affected accounts have already seen their balances drop or even hit zero because white hats moved the assets to safety.
They also made this clear: if you log in with Google / Apple, stop transferring funds into those accounts.
Move any assets you can still access to a wallet secured with a recovery phrase or to a hardware wallet as soon as possible.
Staked and locked assets are more complicated to handle, so users will have to wait.
Wallets created with a recovery phrase and hardware wallets were not affected this time.
I read that sentence twice.
Put simply, convenience comes at a cost.
Social login feels seamless, but your private key is actually held by a third party.
You think it’s your wallet, but the keys aren’t in your hands.
My own rule has always been: big money stays in a hardware wallet.
For small, everyday amounts, I only keep what I wouldn’t mind losing.
This incident was another reminder for me:
Don’t begrudge the extra hassle. In this space, hassle is the cheapest insurance 🔐
One more reminder:
There are definitely going to be a ton of DMs from people impersonating officials, claiming they can “help you recover your assets.”
Don’t believe them, and don’t click anything.
Only trust official Keplr and Web3Auth channels.
Is your primary wallet a recovery-phrase wallet or a social-login wallet?
Let’s talk in the comments.
$ATOM $OSMO
#钱包安全 #市场观察 #Cosmos
This is not investment advice. DYOR. Trading involves risk.