An exploit in Web3Auth’s security has led to a significant breach of Keplr cryptocurrency wallets, affecting users who registered with Google or Apple accounts. The breach was announced by both companies late last week, highlighting a critical vulnerability that allowed an attacker to access these digital wallets.
Web3Auth’s Response to the Breach
Web3Auth, upon discovering the security flaw, proactively moved funds from vulnerable wallets to secure recovery wallets, with the assistance of the wallet maker. This preemptive measure was aimed at protecting user assets from being stolen by the attacker. Users who find their wallets empty may have had their funds temporarily secured rather than stolen.
Wallets established through more secure methods, such as using a recovery phrase or hardware wallet, were reportedly unaffected by this incident. Consequently, Web3Auth has suspended Google and Apple sign-in options as they continue to investigate the breach.
Guidance for Affected Users
For users who established their Keplr accounts using Google or Apple logins, specific instructions have been issued. Users are advised not to send new funds to compromised accounts or attempt to recreate them. Instead, funds should be transferred to wallets utilizing recovery phrases or hardware solutions. Official updates should only be trusted from the wallet maker’s official channels.
Assets that are staked or locked are proving more challenging to secure, and the wallet maker is collaborating with Web3Auth to provide users with tools to verify if their accounts were compromised. A published recovery address list aims to help users differentiate between legitimate and malicious transfers.
Extent and Impact of the Breach
The security flaw, described as a private key breach, allowed unauthorized access to some users’ wallets. Although specific details about the flaw and its exploitation timeline remain undisclosed, approximately 20% of accounts using Google and Apple logins were impacted. However, only a subset of those accounts appeared to have been exploited.
According to GoPlus, a Web3 security firm, the financial impact is estimated at around $1 million. Meanwhile, Bitquery, a blockchain data firm, reported that about $6.01 million was transferred to recovery wallets, initially identified as theft but later clarified as a precautionary rescue.
Wider Implications and Future Outlook
Web3Auth’s issue has implications beyond Keplr, affecting other companies using its services, though Keplr is the only named entity. The service has paused its wallet creation feature, leaving its login capabilities offline.
Consensys, which acquired Web3Auth in June 2025, has been working to integrate social login capabilities into its MetaMask wallet. Despite the breach, no MetaMask users have been reported affected. The incident underscores the ongoing challenge of securing digital wallets and the need for robust security measures as cryptocurrency adoption continues to grow.
