Web3Auth Flaw Compromises Keplr Wallets Created With Google or Apple

Keplr suspended Google and Apple connections on Saturday after discovering suspicious transactions on wallets created with these services. The flaw comes from Web3Auth, the provider responsible for generating and managing private keys. About 44,700 keys were exposed.

Keplr closes the door to Google and Apple connections

On November 7, Keplr alerts its users after detecting unauthorized transactions on accounts created with Google or Apple. The platform immediately suspends these two login methods and advises users not to transfer funds, not to reimport their accounts, and to beware of alleged recovery messages.

The alert comes a few hours after a Web3Auth decision. On November 6 at 21:13 UTC, the provider suspends its integrated wallet service following a security incident. The company, owned by Consensys, specifies that no MetaMask users are affected.

Josh Lee, co-founder of Chainapsis, the company behind Keplr, rules out an internal flaw. According to him, the problem comes directly from Web3Auth and affects about 20% of accounts connected via social networks.

The distinction is important: users who created their wallet with a recovery phrase or a hardware wallet are not concerned. However, those who connect with Google or Apple depend on an external mechanism to rebuild their private key. In other words, their security also relies on that of their provider. Convenience sometimes comes at a price.

Six million dollars moved, not everything disappeared

According to Bitquery’s on-chain analysis, about 6.01 million dollars circulated between November 6 and 7. The movements involve several networks, including Cosmos Hub, Osmosis, Celestia, Akash, Noble, dYdX, Babylon, and Injective.

Cosmos Hub leads with nearly 3.50 million dollars in transfers. Osmosis follows with 1.04 million, ahead of Injective and its 615,000 dollars.

However, this 6 million does not necessarily correspond to stolen funds. On Sunday, Web3Auth published twelve recovery addresses containing assets secured for Keplr users. Their balance reaches about 5.6 million dollars, or 93.2% of the flows recorded by Bitquery.

The difference shows an estimated net loss of 410,000 dollars. Careful though: this calculation remains approximate, as the two analyses don’t cover exactly the same scopes or periods. Web3Auth also disputes the total amount.

Bitquery also counts about 44,700 distinct private keys. The median loss per wallet is only 1.34 dollars, although the largest transfer approaches 325,000 dollars. More worryingly, 86% of wallets affected on seven networks recorded movements after Keplr’s alert.

Finally, nearly 1.96 million ATOM in staking also changed position without awaiting the usual unlocking period of 21 days, thanks to liquid staking.

A rescue operation that raises questions

The recovery of funds has not simplified the situation. Web3Auth explains having organized rescue operations by borrowing the same mechanism used by the attacker.

Result: for several hours, some users saw their assets leave their wallet without knowing whether it was a theft or a recovery operation. Difficult to keep calm when your cryptos walk out unannounced.

This method reveals above all a structural weakness. Web3Auth retains the ability to sign transactions on behalf of its users, even during a security crisis. Recovery therefore depends largely on the speed and coordination of technical teams.

For now, neither Web3Auth nor Keplr has communicated a precise timetable to restore social logins or compensate victims.

The matter recalls a fundamental rule of the crypto ecosystem: controlling your assets also means controlling your keys. Because when a provider encounters a problem, the promise of a non-custodial wallet can quickly lose its substance. As other cases related to key custody and fund control show, ease of use does not always guarantee independence.