🚨 44,000 wallets, $6.01 million, hit in two days—this time, the problem wasn’t the blockchain, but the habit of “logging in with Google”
Group: 邀请您加入我的群组 悟空粉丝群
On November 6–7, Keplr, a wallet in the Cosmos ecosystem, was hit. On-chain data firm Bitquery tracked about $6.01 million in assets being transferred out, involving 44,041 wallet addresses.
🔸 Seven Cosmos networks were affected: about $3.5 million on Cosmos Hub, as well as Osmosis, Celestia, Akash, Noble, Babylon, and dYdX. Another 7,603 addresses were affected on Injective. After removing duplicates across networks, about 44,700 unique wallets were involved.
On November 7, Keplr issued a security notice and suspended Google and Apple account logins. Co-founder Josh Lee said that affected accounts may account for 20% of the platform’s social-login users, and that only a portion were actually drained.
🔸 Responsibility was clearly attributed: Keplr’s own wallet code wasn’t compromised; the issue was with Web3Auth. The authentication provider, which makes “embedded wallets,” is owned by Consensys. It suspended its service afterward and said its preliminary investigation found no impact on MetaMask users.
⚠️ But Web3Auth hasn’t disclosed the full technical attack vector or named other affected wallets. The answer users most want to know is precisely the one it isn’t sharing for now.
What really deserves attention isn’t “another wallet getting hacked,” but the fact that the private keys for these kinds of wallets are never in users’ hands to begin with. Tap “Log in with Google,” and you’re effectively handing your recovery phrase over to a third-party server to manage.
📌 Convenience and security have always been a zero-sum trade-off in the wallet space. Want one-click access? Then you have to accept someone else holding your keys. Want true self-custody? Then you have to take on the hassle yourself.
How many wallets on your phone still use social account logins? Join the conversation in the comments 👇
Tap my profile picture to watch the livestream + join my fan group for daily strategies 🚀
#公链 #DeFi #CryptoRegulation
Group: 邀请您加入我的群组 悟空粉丝群
On November 6–7, Keplr, a wallet in the Cosmos ecosystem, was hit. On-chain data firm Bitquery tracked about $6.01 million in assets being transferred out, involving 44,041 wallet addresses.
🔸 Seven Cosmos networks were affected: about $3.5 million on Cosmos Hub, as well as Osmosis, Celestia, Akash, Noble, Babylon, and dYdX. Another 7,603 addresses were affected on Injective. After removing duplicates across networks, about 44,700 unique wallets were involved.
On November 7, Keplr issued a security notice and suspended Google and Apple account logins. Co-founder Josh Lee said that affected accounts may account for 20% of the platform’s social-login users, and that only a portion were actually drained.
🔸 Responsibility was clearly attributed: Keplr’s own wallet code wasn’t compromised; the issue was with Web3Auth. The authentication provider, which makes “embedded wallets,” is owned by Consensys. It suspended its service afterward and said its preliminary investigation found no impact on MetaMask users.
⚠️ But Web3Auth hasn’t disclosed the full technical attack vector or named other affected wallets. The answer users most want to know is precisely the one it isn’t sharing for now.
What really deserves attention isn’t “another wallet getting hacked,” but the fact that the private keys for these kinds of wallets are never in users’ hands to begin with. Tap “Log in with Google,” and you’re effectively handing your recovery phrase over to a third-party server to manage.
📌 Convenience and security have always been a zero-sum trade-off in the wallet space. Want one-click access? Then you have to accept someone else holding your keys. Want true self-custody? Then you have to take on the hassle yourself.
How many wallets on your phone still use social account logins? Join the conversation in the comments 👇
Tap my profile picture to watch the livestream + join my fan group for daily strategies 🚀
#公链 #DeFi #CryptoRegulation
