GoPlus Links Web3Auth Flaw to at Least $1 Million in Keplr Theft

GoPlus has identified a security weakness in Web3Auth tied to theft of at least $1 million from Keplr wallets set up through Google or Apple sign-in.

GoPlus connected the incident to Web3Auth, the social-login service used during setup of the affected wallets. The compromise involved exposed private keys in some cases and stolen authority to sign transactions in others.

At least $1 million in assets was stolen. About $6 million in assets was also transferred to an official rescue address, a separate movement in the incident.

Keplr wallets made using Google or Apple sign-in were identified as affected. Wallets created with mnemonic phrases and hardware wallets were not affected.

The theft figure is a minimum. The two amounts describe different actions: assets stolen and assets sent to a rescue address. The affected wallets were a subset created through social sign-in, specifically Google or Apple. The incident involved both wallet access and asset movements.