Keplr wallets hit by Web3Auth social-login flaw; ~$1M stolen, ~$6M moved to recovery address

GoPlus Security reports that Keplr wallets created via Google or Apple login were compromised through a Web3Auth social-login vulnerability, with private keys exposed or signing capability hijacked. At least roughly $1M was stolen, while about $6M was moved to an official recovery address. Seed-phrase and hardware-wallet users are unaffected. Five attacker-linked Ethereum addresses were listed. Users are advised to ignore fake recovery links, stop funding old social-login accounts, and migrate assets to fresh seed-phrase or hardware wallets. Keplr shared verified Cosmos, Osmosis, and Celestia recovery addresses.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Wallet