Keplr and Web3Auth say Web3Auth flaw hit Google and Apple login wallets

What happened

According to The Hacker News, Keplr and Web3Auth said late last week that an attacker used a security flaw at Web3Auth to reach some Keplr wallets created with Google or Apple sign-in. The outlet reports that Web3Auth describes a security issue in its own infrastructure affecting certain wallets it provides inside the Keplr app. Keplr, per the same outlet, says the flaw led to a “private key breach” for some users who signed in with Google or Apple. The account of the flaw comes from the two companies themselves, as relayed by The Hacker News. The outlet also cites GoPlus (a Web3 security company) and Bitquery (a blockchain data firm), but they comment on amounts and transfers, and none of the sources independently verifies how the flaw worked.

The Hacker News reports that Web3Auth then used the attacker’s own route to empty other at-risk wallets before the attacker could, moving funds with the wallet maker’s help into recovery wallets for safekeeping. According to the outlet, an empty balance may therefore mean funds were rescued rather than stolen. Web3Auth says the moved funds are safe and that it is working with Keplr to return them, but has not said how or when.

What is not confirmed:

• How the flaw worked, when the attacker first used it, and whether the route is now closed: neither company has said, per The Hacker News.
• A dollar figure for the theft: neither company has given one. GoPlus says at least about $1 million was stolen, without explaining how it reached that figure. Keplr co-founder Josh Lee gave an early estimate that about 20% of Google and Apple login accounts were affected, and only a fraction of those appeared exploited.
• Who controls the recovery wallets: Bitquery says it cannot check this. The firm counted at least $6.01 million moving from more than 44,000 wallets into the recovery wallets by late last week. It first reported the transfers as theft, then issued a corrected analysis treating them as the rescue. Its data shows 86% of the wallets were emptied after the wallet maker warned users.

Am I affected?

Per The Hacker News, based on Keplr’s statements:

• Possibly affected: Keplr accounts created with Google or Apple login. Keplr has paused that sign-in while it investigates, and says it is working with Web3Auth on a way for users to check whether their account was affected. That tool is not yet confirmed as available.
• Not affected, according to Keplr: wallets made with a recovery phrase (12 or 24 words) or a hardware wallet.
• Other apps: Web3Auth says the issue affects its services used by some other companies, but names only Keplr. It paused its embedded wallet service, and its status page still showed the login service as down, per the outlet. Which other apps are affected is not confirmed.
• MetaMask: Consensys bought Web3Auth in June 2025. Web3Auth says its initial investigation found “no evidence that MetaMask users are impacted,” per The Hacker News.

What to do now

1. Do not send new funds to any Keplr account created with Google or Apple login (Keplr guidance, per The Hacker News).
2. Do not re-import or recreate the account anywhere.
3. Move funds that are not staked or locked to an account that uses a recovery phrase or a hardware wallet.
4. Treat staked and locked assets as pending: the outlet reports they are taking longer to secure.
5. If your balance is empty, do not assume theft. Web3Auth has published a recovery address list that it says lets people tell its own transfers apart from possibly malicious ones. It also warns against assuming an unfamiliar destination address belongs to the attacker.
6. Trust updates only from the official accounts of Keplr and Web3Auth, and ignore direct messages or links that offer “recovery.”
7. If you build on Web3Auth embedded wallets, watch Web3Auth’s incident updates and status page. Whether your integration is affected is not confirmed in the sources.

Sources

• The Hacker News: Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety