Web3Auth, a Consensys-owned service that enables Google and Apple sign-ins for the crypto wallet Keplr, has moved approximately $5.6 million out of vulnerable Keplr wallets to prevent further exploitation. The action was taken in response to a flaw in Web3Auth's systems that exposed the private keys of some Keplr Wallet users who signed up with Google or Apple accounts. As of publication time on Sunday, the 12 addresses holding the recovered funds contained about $5.6 million in crypto, according to onchain data reviewed by The Block.
The incident did not stem from a hack of Keplr's code but originated at Web3Auth, a provider used by Keplr. Keplr co-founder Josh Lee estimated that about 20% of Keplr's Google and Apple login accounts were affected. Users who set up Keplr with a recovery phrase or a hardware wallet were not impacted.
Web3Auth began emptying vulnerable wallets that the attacker had not yet reached, using the same method as the original attacker. The firm noted that some of these transactions were mistaken for further attacker activity. Blockchain analytics firm Bitquery reported that a thief collected about $6 million from over 44,000 Keplr wallets, all of which were tied to Web3Auth's recovery list.
Most of the recovered funds are on Cosmos Hub, where Web3Auth's recovery address holds about 2.49 million ATOM, worth roughly $3.3 million. Keplr advised users to move any remaining funds to a wallet secured by a recovery phrase or a hardware device and warned that some accounts may already show a reduced or empty balance due to mitigation efforts. Web3Auth first disclosed the issue on Friday afternoon and paused the service that lets apps create wallets through social logins.