Web3Auth Flaw Leads to Keplr Crypto Theft; Provider Empties At-Risk Wallets

Security Flaw Discovered

An attacker exploited a security flaw within Web3Auth, the service Keplr uses for Google and Apple account sign-ins. This flaw led to a "private key breach" for some Keplr users, allowing the attacker to access and steal funds from their cryptocurrency wallets. The private key is essential for authorizing transactions from a wallet.

Web3Auth's Response and Mitigation

Following the attack, Web3Auth utilized the attacker's method to identify and empty other at-risk wallets before the attacker could access them. These funds were moved to recovery wallets for safekeeping, with assistance from Keplr. Therefore, an empty balance in an affected wallet may indicate that funds were rescued rather than stolen.

Affected Users and Recommendations

The incident primarily affects Keplr wallets created using Google or Apple login. Wallets set up with a recovery phrase or a hardware wallet are not impacted. Keplr has paused Google and Apple sign-in options during the investigation. Affected users are advised not to send new funds to their accounts, avoid re-importing them, and move any unstaked or unlocked funds to accounts secured by a recovery phrase or hardware wallet.

Ongoing Investigation and User Guidance

Neither Web3Auth nor Keplr has disclosed the specifics of how the flaw worked, when the attack began, or if the vulnerability is fully patched. Keplr co-founder Josh Lee estimated that approximately 20% of Google and Apple login accounts were affected, with only a fraction of those actually exploited. Both companies are working on a method for users to check if their accounts were compromised and have published a recovery address list to help users distinguish legitimate transfers from potentially malicious ones.