Keplr: Unauthorized Transactions Impact Wallets Created via Google or Apple

Coin Encyclopedia Improve your knowledge of cryptos

Keplr offers its users to create a wallet from a Google or Apple account. This option is based on Web3Auth, a service provider that allows you to configure a wallet without having to manage a recovery phrase when creating it. After initial reports, Web3Auth suspended its in-app wallets service and Keplr disabled both affected login methods.

Josh Lee, co-founder of Keplr, places the origin of the incident in the Web3Auth infrastructure. According to its preliminary estimate, around 20% of Keplr accounts created through Google or Apple may have been exposed. He estimates that only a fraction of these accounts have suffered malicious operations.

Web3Auth and Keplr transferred assets to secure wallets to hide them from the attacker. Bitquery initially interpreted these movements as theft. The company revised its analysis after publishing the list of recovery addresses on November 8. These held approximately $6.01 million at the time of Bitquery's November 7 statement.

Keplr asks affected users to no longer fund these wallets. Those who still have access can, as directed by the team, move their available assets to a wallet created with a recovery phrase or hardware device. Assets that are blocked or staked take longer to process.

The Keplr and Web3Auth teams have yet to establish the balance sheet of the losses and specify the terms of restitution of the protected funds. The $6.01 million traced by Bitquery gives a measure of the security operation in progress. Fall is definitely complicated for storage solutions of all kinds.

With a background in literature and languages, I like to combine rigorous analysis with a taste for ideas to decipher the major economic and (geo)political issues linked to cryptocurrencies. Since 2021, I have been writing for Journal du Coin where I focus on subjects such as Bitcoin, MNBC, the tokenization of RWA and more broadly the strategic mutations of Web3. A passionate reader, curious about the world and the power relationships that structure it, I strive to make these themes accessible to all, with particular attention to projects designed for the general public.

The news that matters, summarized in 2 minutes. Monday to Friday, in your inbox.

This site uses Google Analytics to collect anonymous information such as the number of visitors to the site and the most popular pages.

Machine-translated from French