Web3Auth security flaw compromises Keplr wallet private keys
A security flaw in Web3Auth's infrastructure compromised the private keys of some Keplr wallets created using Google or Apple accounts, resulting in unauthorised transactions. Web3Auth suspended its service and moved approximately $5.6 million to a recovery wallet to prevent further theft. The amount actually stolen by the attacker was not disclosed.
Key facts
- Affected organisation
- Web3Auth
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Private keys compromised and assets stolen from some Keplr wallets; actual amount stolen undisclosed
- Cause / method
- A security flaw in Web3Auth's infrastructure exposed the private keys of wallets created through social login
- Location
- Other countries
If your data was exposed
Exposed dataCrypto assets
- Check login and withdrawal history in your exchange app, and turn on withdrawal address whitelisting and withdrawal delays.
Timeline
- Private key compromises and unauthorised transactions were confirmed in some Keplr wallets due to a Web3Auth security issue.
- Web3Auth announced that it had suspended its service and moved approximately $5.6 million to a recovery wallet.
Also affected by this incident
Keplr social-login wallet keys exposed, assets stolen
↳ Knock-on damage from the Web3Auth incident · View original incidentImpact: At least KRW 2.4 billion in cryptoassets stolen
A security flaw in Web3Auth infrastructure exposed the private keys of some Keplr wallets created using Google or Apple login and led to unauthorised asset transfers. Keplr suspended these login options, while Web3Auth moved assets from at-risk wallets to recovery wallets. The approximately $6.01 million in transferred assets included protective transactions, and on 13 November, theft losses of at least KRW 2.4 billion were reported.
Related reports: 7 · last report →
4 related reports
- Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
- Web3Auth pauses embedded wallet service after security issue, Keplr users hit
- Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets
- Binance warns of iOS flaw that could leak crypto wallet secrets
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.