Keplr Social Login Vulnerability Prompts Emergency Protection of $5.6 Million in Assets

A security vulnerability was found in the social login system used by crypto wallet Keplr, prompting its service provider to take emergency action to protect user assets.

The Block reported on November 8 that Web3Auth, a Web3 authentication service, confirmed a flaw that exposed the private keys of some users who signed up for Keplr wallets with Google or Apple accounts. It moved assets from wallets exposed to the attack risk to separate recovery addresses. The 12 recovery addresses disclosed by Web3Auth held about $5.6 million in crypto assets as of that day.

The vulnerability originated with external login provider Web3Auth, not with the Keplr wallet itself. Keplr co-founder Josh Lee estimated that about 20% of Google and Apple login accounts were affected. The number of accounts actually exploited appears to be smaller. Accounts protected by seed phrases or hardware wallets were not affected.

Web3Auth contained the damage by preemptively moving assets out of vulnerable wallets that attackers had not yet accessed. Those transfers were at times mistaken for hacker theft. Blockchain analytics firm Bitquery had earlier estimated that about $6 million had been stolen from more than 44,000 Keplr wallets, but all eight addresses it identified as linked to the attacker were included among Web3Auth's recovery addresses.

Most of the recovered assets are being held on the Cosmos Hub network. Web3Auth's recovery addresses hold about 2.49 million ATOM, valued at about $3.3 million. The amount actually stolen by attackers, and the number of affected wallets, have not yet been confirmed.

Keplr advised users who log in through Google or Apple not to make additional deposits into their existing wallets and to move any remaining assets to new wallets protected by a seed phrase or hardware device. It added that cases in which balances appear reduced or missing may reflect emergency transfers made to protect assets.

Web3Auth first disclosed the vulnerability on November 6 and temporarily suspended its social-login-based wallet creation service. The company said it had found no evidence that the same issue affected MetaMask users. Web3Auth was acquired by Consensys in June last year and is now offered as MetaMask Embedded Wallets.