SECURITY ALERT · UPDATE 1

Some of the wallets that emptied on Saturday were emptied by the rescuers.

Nobody has yet said which ones.

Keplr says a vulnerability in Web3Auth’s infrastructure led to a private key breach for some users who signed in with Google or Apple, and it is now telling those users to move any remaining liquid assets out, according to a post on its official X account at 17:17 UTC on Saturday 7 Nov.

Wallets created with a recovery phrase or a hardware wallet are not affected, Keplr says.

This follows Keplr paused Google and Apple login earlier on Saturday after reports of unauthorised transactions.

The timeline

  • 16:53 UTC: Web3Auth says it has identified “a security issue in Web3Auth infrastructure affecting certain embedded wallets used by Keplr”. It says it has been working to secure assets from affected accounts with Keplr’s help, and that parts of that work are complex and may take time.
  • 17:06 UTC: Web3Auth says it and its partners began whitehat recovery on wallets that were vulnerable but not yet hit, using the same path as the original attacker. It adds that some of those transfers have been mistaken for the attacker’s, and that funds recovered this way are safe.
  • 17:07 UTC: Web3Auth says it is preparing a verified list of recovery addresses, and asks users not to assume an unfamiliar destination belongs to the attacker.
  • 17:17 UTC: Keplr says some Google and Apple login accounts “may already show a reduced or empty balance” because of that mitigation work. Staked and locked assets take longer, it adds.

So an empty balance is not, by itself, proof of theft.

Is it proof of rescue?

What is not known yet

Neither company has said how many wallets were affected, how much the attacker took, or how much has been secured.

Web3Auth has not yet published the recovery-address list as of 20:50 UTC, so users cannot yet tell a rescue transfer from a theft on-chain.

Keplr says it is working with Web3Auth on a way for users to check whether their account is affected. Neither has explained how returned funds will reach their owners, beyond “a path to recovery”.

Figures circulating on social media remain unconfirmed by either company, and we have not used them.

The Defiant also reported the recovery explanation.

Protect yourself

  • If your Keplr wallet was created with Google or Apple login, do not send new funds to it, Keplr says.
  • Move any remaining liquid assets to a wallet secured by a recovery phrase or a hardware wallet, Keplr says. Background on what a private key is and why it matters here.
  • Trust updates only from Keplr’s and Web3Auth’s official accounts. Both warn that messages or links offering “recovery” may be phishing.
  • Do not treat an unfamiliar outgoing transfer as the attacker’s until Web3Auth’s verified address list is out.

Like Gnosis Pay’s card-system breach this week, the failure sat in a service beside the wallet, not on the chain.

When the rescue and the theft use the same door, who decides which one you were?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.