Web3Auth Flaw Leads to Keplr Wallet Fund Theft, Provider Empties Other Wallets
A vulnerability in Web3Auth's authentication service allowed attackers to steal cryptocurrency from Keplr wallets linked to Google and Apple accounts, prompting the provider to drain other affected wallets for safekeeping.
A significant security flaw within the Web3Auth authentication service has been exploited, leading to the theft of cryptocurrency from users of the Keplr wallet who had linked their accounts via Google or Apple.
Web3Auth, a provider of social login services for cryptocurrency wallets, confirmed that a security issue within its own infrastructure impacted certain wallets integrated into the Keplr application. Keplr elaborated that this flaw resulted in a "private key breach" for some users, granting attackers the ability to approve and execute transactions from compromised wallets.
The exact technical details of the vulnerability and the timeline of its exploitation remain undisclosed by both Web3Auth and Keplr. However, the breach allowed attackers to access and drain funds from affected wallets. In a proactive measure to mitigate further losses, Web3Auth, in collaboration with Keplr, initiated a process to empty other at-risk wallets, transferring the funds to secure recovery wallets.
Users who created their Keplr wallets using a recovery phrase or a hardware wallet are reportedly unaffected by this incident. Web3Auth has temporarily suspended Google and Apple sign-in options while its investigation continues. The company has advised affected users to avoid sending new funds to their compromised accounts, refrain from re-importing or recreating their wallets, and to move any available funds to a more secure wallet setup (recovery phrase or hardware wallet).
While neither company has disclosed the total financial loss, security firm GoPlus estimated that at least $1 million was stolen. Blockchain data firm Bitquery tracked over $6 million moved from more than 44,000 wallets into recovery wallets, initially reporting these as thefts before revising their analysis to reflect a rescue operation. The majority of these fund transfers occurred after Web3Auth issued its initial warning to users.
The incident highlights the risks associated with relying on third-party authentication services for managing digital assets. The compromised Web3Auth service is also used by other companies, though Keplr is the only named victim so far. Consensys, which acquired Web3Auth in June 2025, stated that its initial investigation found no evidence of impact on MetaMask users.
Web3Auth is working with Keplr to facilitate the return of rescued funds to users, though the timeline and method for this process have not yet been detailed. The provider has also warned users against trusting unsolicited messages or links offering recovery services, emphasizing the importance of obtaining updates only from official channels.
This event underscores the critical need for robust security practices in the Web3 ecosystem, particularly concerning private key management and the security of authentication infrastructure. The ongoing investigation aims to shed more light on the vulnerability and prevent future occurrences.