At least around $1 million is gone from Keplr social login wallets.
On November 9, GoPlus reported that a vulnerability in Web3Auth, which Keplr uses, exposed some users’ private keys and let attackers steal their ability to sign transactions. Keplr wallets created by signing in with Google or Apple were affected; seed phrase and hardware wallets were not.
At least around $1 million in assets has been stolen, while another roughly $6 million was transferred to an officially confirmed rescue address. Convenience and security are two different things: social login saves a step, but your private keys may not be in your own hands.
1️⃣ Check your balance and approvals for any unfamiliar transfers or approvals
2️⃣ If you can still transfer your funds, move them to a wallet whose private keys you control
3️⃣ Don’t use a social login wallet as your main wallet anymore; keep larger amounts in a seed phrase or hardware wallet
Do you know anyone who created a Keplr wallet by signing in with Google or Apple? #Keplr
On November 9, GoPlus reported that a vulnerability in Web3Auth, which Keplr uses, exposed some users’ private keys and let attackers steal their ability to sign transactions. Keplr wallets created by signing in with Google or Apple were affected; seed phrase and hardware wallets were not.
At least around $1 million in assets has been stolen, while another roughly $6 million was transferred to an officially confirmed rescue address. Convenience and security are two different things: social login saves a step, but your private keys may not be in your own hands.
1️⃣ Check your balance and approvals for any unfamiliar transfers or approvals
2️⃣ If you can still transfer your funds, move them to a wallet whose private keys you control
3️⃣ Don’t use a social login wallet as your main wallet anymore; keep larger amounts in a seed phrase or hardware wallet
Do you know anyone who created a Keplr wallet by signing in with Google or Apple? #Keplr
