Keplr Says Web3Auth Flaw Exposed Some Social Login Keys

Keplr said a vulnerability in Web3Auth infrastructure exposed private keys belonging to some users who created wallet accounts by signing in with Google or Apple, putting assets in those accounts at risk.

Accounts created with a recovery phrase or hardware wallet were not affected, Keplr said. The wallet provider is working with Web3Auth to protect assets in affected accounts, but handling staked or locked funds is taking longer.

Keplr said some social login accounts showing lower or zero balances may reflect asset protection measures. It warned users not to deposit new funds into their original accounts and advised moving any remaining transferable assets to an account created with a recovery phrase or hardware wallet.

Keplr and Web3Auth are developing a tool to help users determine whether their accounts were affected. Keplr is a wallet in the Cosmos ecosystem.