Web3Auth Flaw Leads to Keplr Wallet Key Exposure, Funds Moved to Recovery Wallets

Users who signed in to Keplr with Google or Apple should avoid sending new funds and move unstaked balances to recovery-phrase or hardware wallets.

An attacker exploited a security flaw in Web3Auth's infrastructure to access some Keplr wallets created through Google or Apple sign-in, with Keplr describing it as a private key breach. Web3Auth then used the same route to move at-risk funds into secure recovery wallets, so an emptied balance may reflect a rescue rather than theft. Bitquery counted at least $6.01 million moved from more than 44,000 wallets, and it has since revised its analysis to treat those transfers as the rescue, though it cannot verify who controls the recovery wallets. Keplr has paused Google and Apple sign-in, and users are advised to avoid sending new funds, avoid re-importing accounts, and move unstaked funds to recovery-phrase or hardware wallets. Web3Auth has paused its embedded wallet service and says the issue may affect other companies' services, though it has named only Keplr and reports no evidence that MetaMask users are affected.