Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker; keplr uses a company called Web3Auth to run that Google and Apple sign-in.
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker; keplr uses a company called Web3Auth to run that Google and Apple sign-in.
The attacker used a security flaw at that company to reach the wallets, both companies said late last week.
It has also warned users not to assume that an unfamiliar destination address is linked to the attacker.
Josh Lee, a Keplr co-founder, gave an early estimate in his initial findings: about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited.
Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, it said; so an empty balance may mean the money was rescued, not stolen.
What happened
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker; keplr uses a company called Web3Auth to run that Google and Apple sign-in.
The attacker used a security flaw at that company to reach the wallets, both companies said late last week.
What changed
It has also warned users not to assume that an unfamiliar destination address is linked to the attacker.
Josh Lee, a Keplr co-founder, gave an early estimate in his initial findings: about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared to have been exploited.
Why it matters
Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, it said; so an empty balance may mean the money was rescued, not stolen.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.