A wallet that lets you sign in with a Google or Apple account in one tap has run into trouble over the past couple of days.
The Keplr wallet team has confirmed that a vulnerability in the infrastructure of its third-party login service, Web3Auth, exposed the private keys of some Keplr accounts created using Google or Apple sign-in. Unauthorized transfers have already been reported. Keplr has now suspended Google and Apple sign-in.
The team says accounts created with a seed phrase or hardware wallet are not affected. The issue is with the “seedless” login option: your private key isn’t in your hands; a third-party service generates and manages it for you. If that service has a vulnerability, your wallet is exposed too.
The team’s advice is straightforward: if you signed in with Google or Apple, don’t deposit any more funds into that account for now. Transfer any assets you can to an account created with a seed phrase or hardware wallet. Some accounts have also had their balances reduced or emptied; this may be due to protective transfers by the team and doesn’t necessarily mean everything was stolen. Wait for the official lookup tool for details.
A tip for beginners: after a security incident, anyone who DMs you saying they can “help recover your assets” is almost certainly a scammer. Only trust updates from the official Keplr and Web3Auth accounts.
Did you create your wallet with a seed phrase, or sign in with a social account for convenience?
#Keplr #钱包安全 #ScamPreventionGuide
The Keplr wallet team has confirmed that a vulnerability in the infrastructure of its third-party login service, Web3Auth, exposed the private keys of some Keplr accounts created using Google or Apple sign-in. Unauthorized transfers have already been reported. Keplr has now suspended Google and Apple sign-in.
The team says accounts created with a seed phrase or hardware wallet are not affected. The issue is with the “seedless” login option: your private key isn’t in your hands; a third-party service generates and manages it for you. If that service has a vulnerability, your wallet is exposed too.
The team’s advice is straightforward: if you signed in with Google or Apple, don’t deposit any more funds into that account for now. Transfer any assets you can to an account created with a seed phrase or hardware wallet. Some accounts have also had their balances reduced or emptied; this may be due to protective transfers by the team and doesn’t necessarily mean everything was stolen. Wait for the official lookup tool for details.
A tip for beginners: after a security incident, anyone who DMs you saying they can “help recover your assets” is almost certainly a scammer. Only trust updates from the official Keplr and Web3Auth accounts.
Did you create your wallet with a seed phrase, or sign in with a social account for convenience?
#Keplr #钱包安全 #ScamPreventionGuide