A critical vulnerability within the infrastructure of Web3Auth has left many cryptocurrency users scrambling after attackers targeted Keplr wallets created via Google and Apple sign-ins. According to statements from both companies, a private key breach allowed unauthorized parties to access several accounts, potentially compromising millions of dollars in digital assets. While the exact mechanism of the exploit remains undisclosed, the breach specifically hit those using social logins rather than traditional recovery phrases or hardware wallets, which remain unaffected.
In an unusual turn of events, Web3Auth took preemptive action by utilizing the same pathway as the attacker to drain at-risk wallets before they could be looted. This means that some users waking up to find an empty balance may actually have had their funds rescued rather than stolen. Data suggests over six million dollars were shifted into secure recovery wallets across various blockchains during this emergency operation, although independent security firms like GoPlus estimate that roughly one million dollars were successfully stolen by the hacker.
Keplr has responded by pausing all Google and Apple sign-in options while investigations continue. Users who utilized these methods are being urged to stop sending new funds to those accounts and avoid recreating them elsewhere until a formal fix is implemented. For those with remaining liquid assets, the recommendation is to migrate immediately to a wallet secured by a seed phrase or physical hardware device. Assets that are currently staked or locked are proving more difficult to secure quickly, leaving some investors in a state of limbo.
The fallout extends beyond just Keplr, as Web3Auth admitted that its broader embedded wallet services were compromised, leading to a temporary shutdown of its login systems globally. Consensys, the parent company of MetaMask and owner of Web3Auth, stated there is currently no evidence that MetaMask users were impacted by the event. As both companies work toward returning salvaged funds to their rightful owners, they have cautioned users to beware of phishing attempts and fake recovery links appearing in direct messages following the chaos.