Web3Auth Sweeps $5.6 Million From Keplr Wallets After a Key Exposure Flaw, Citing a Race With the Attacker

Web3Auth, the Consensys-owned service that powers Google and Apple sign-in for the Keplr wallet, says a flaw in its systems exposed the private keys of some Keplr users, and that it moved their funds to addresses it controls to keep them from an attacker. The Block reported on November 8 that Web3Auth first disclosed the issue on Friday, November 6, and paused its social-login wallet service.

On Saturday, Web3Auth said it had begun emptying vulnerable wallets the attacker had not yet reached, “using the same path of the original attacker.” Bitquery reported that a thief had collected about $6 million from more than 44,000 Keplr wallets. Early Sunday, Web3Auth published 12 recovery addresses that held about $5.6 million at the time of The Block’s review, mostly about 2.49 million ATOM worth roughly $3.3 million on Cosmos Hub. The Block noted that figure is not a measure of total losses and that Web3Auth has not said how many wallets were hit or how much was stolen.

Keplr co-founder Josh Lee said the incident originated at Web3Auth rather than in Keplr’s code, and estimated that about 20% of Keplr’s Google and Apple login accounts were affected. Keplr says users with a recovery phrase or hardware wallet are not affected, and Web3Auth found no evidence that MetaMask users were hit. Web3Auth acknowledged some of its transactions were mistaken for attacker activity and said it is working with Keplr on a recovery path.

Track the market yourself with AiTraderView’s FREE tools: Crypto Cockpit for charts and 75+ indicators, Crypto Screener to find setups, and Crypto Portfolio to follow your holdings. Just create a FREE account and try them yourself!

Sources:

• The Block: Web3Auth says it frontran hackers by moving $5.6 million out of exposed Keplr wallets

• Crypto Insiders: Aanval legt privesleutels van cryptowallets bloot, schade onbekend