First, a counterintuitive fact: if your wallet balance drops to 0, this time it may have been the “good guys” who did it
On November 8, Keplr officially confirmed a vulnerability in Web3Auth’s infrastructure: private keys were exposed for some wallets created using Google or Apple sign-in.
The official advice: stop sending money to these accounts, and transfer any remaining assets to a wallet secured with a recovery phrase or a hardware wallet.
What kind of wallet is this?
You can create a wallet with one-click Google sign-in. It’s convenient—you don’t have to write down 24 recovery words.
But your private key is generated and managed by a third party, Web3Auth.
The vulnerability was in its infrastructure, not your Google password.
Here’s the most important thing to remember.
After the vulnerability was discovered, Web3Auth launched a white-hat recovery effort: coins in wallets that hadn’t yet been hacked were moved to secure addresses.
So some people suddenly saw their balances drop to zero—not because hackers stole the funds, but because the rescue team moved them.
The official team also published verified recovery addresses, so don’t mistake these transfers for an attack.
But the move itself is controversial.
A third party moved your coins without your consent.
They really were trying to save you, and they really did act first and ask later.
Do you think this was responsible, or an overreach?
A few figures you can verify
A co-founder’s preliminary estimate: about 20% of social-login accounts were affected, but only a small fraction were actually emptied.
There was also an on-chain bulk transfer of 2,266 staked tokens, $ATOM —the official team says it was a recovery operation. The destination hasn’t moved the funds to date, so the mystery is still being investigated.
If you use social login, do these three things now:
Stop sending new funds to the original account.
Move liquid assets to a wallet secured with a recovery phrase or a hardware wallet.
Don’t touch staked or locked assets; wait for the official team to handle them.
One more thing: anyone who sends you a private message claiming they can help recover your assets is a scammer.
Remember this rule: to figure out whether a wallet is secure, first ask, “Who holds the private key?”
Social login means custodial; recovery phrases and hardware wallets mean self-custody.
Convenience and self-custody have always involved a trade-off.
What kind of login does your wallet use? Drop a number in the comments.
I’m betting that within 48 hours, phishing scams impersonating “asset recovery” services will appear, with losses exceeding a million dollars. Come back then and we’ll see if I was right.
#Keplr建议社交登录用户转移资产
On November 8, Keplr officially confirmed a vulnerability in Web3Auth’s infrastructure: private keys were exposed for some wallets created using Google or Apple sign-in.
The official advice: stop sending money to these accounts, and transfer any remaining assets to a wallet secured with a recovery phrase or a hardware wallet.
What kind of wallet is this?
You can create a wallet with one-click Google sign-in. It’s convenient—you don’t have to write down 24 recovery words.
But your private key is generated and managed by a third party, Web3Auth.
The vulnerability was in its infrastructure, not your Google password.
Here’s the most important thing to remember.
After the vulnerability was discovered, Web3Auth launched a white-hat recovery effort: coins in wallets that hadn’t yet been hacked were moved to secure addresses.
So some people suddenly saw their balances drop to zero—not because hackers stole the funds, but because the rescue team moved them.
The official team also published verified recovery addresses, so don’t mistake these transfers for an attack.
But the move itself is controversial.
A third party moved your coins without your consent.
They really were trying to save you, and they really did act first and ask later.
Do you think this was responsible, or an overreach?
A few figures you can verify
A co-founder’s preliminary estimate: about 20% of social-login accounts were affected, but only a small fraction were actually emptied.
There was also an on-chain bulk transfer of 2,266 staked tokens, $ATOM —the official team says it was a recovery operation. The destination hasn’t moved the funds to date, so the mystery is still being investigated.
If you use social login, do these three things now:
Stop sending new funds to the original account.
Move liquid assets to a wallet secured with a recovery phrase or a hardware wallet.
Don’t touch staked or locked assets; wait for the official team to handle them.
One more thing: anyone who sends you a private message claiming they can help recover your assets is a scammer.
Remember this rule: to figure out whether a wallet is secure, first ask, “Who holds the private key?”
Social login means custodial; recovery phrases and hardware wallets mean self-custody.
Convenience and self-custody have always involved a trade-off.
What kind of login does your wallet use? Drop a number in the comments.
I’m betting that within 48 hours, phishing scams impersonating “asset recovery” services will appear, with losses exceeding a million dollars. Come back then and we’ll see if I was right.
#Keplr建议社交登录用户转移资产
