GoPlus Links Web3Auth Flaw to Keplr Wallet Theft

GoPlus identified at least $1 million in assets stolen from Keplr wallets and linked the incident to a security weakness in Web3Auth, the social-login service used during setup of the affected wallets. About $6 million in assets was also transferred to an official rescue address, a separate movement in the incident.

The theft total is a minimum, while the roughly $6 million rescue-address transfer should not be treated as an offset to reported losses or as proof that user funds were fully recovered.

A failure limited to social-login setup

GoPlus connected the incident to Web3Auth during the creation of a subset of Keplr wallets through Google or Apple sign-in. The affected wallets used social authentication rather than a mnemonic phrase or hardware device.

Wallets based on mnemonic phrases, as well as hardware wallets, were not affected in the identified incident. The finding therefore does not describe a compromise across every Keplr installation or every Web3Auth-supported setup method.

The relevant boundary is narrower: Google or Apple sign-in wallets fall within the affected subset, while mnemonic-based and hardware wallets fall outside it. That distinction limits the operational exposure identified by GoPlus.

Two forms of wallet exposure

The compromise operated through two different control failures. GoPlus found exposed private keys in some affected wallets and stolen authority to sign transactions in others.

• Some cases involved exposed private keys, placing key custody directly at risk.
• Other cases involved stolen transaction-signing authority, allowing assets to be moved without requiring the wallet’s private key to be exposed.

Private-key exposure and stolen signing authority have different operational consequences. One centers on control of key material; the other centers on control of transaction authorization. A wallet may therefore show no obvious key compromise while still carrying the authority needed to transfer assets.

GoPlus also characterized the incident as involving both wallet access and asset movements. Identifying the affected wallet-creation method establishes the exposure category, but it does not by itself quantify each movement made from those wallets.

What does this change for Keplr users?

The practical answer is narrower than a blanket warning about self-custody wallets. Users first need to determine how their Keplr wallet was created, because GoPlus identified only the subset established through Google or Apple sign-in as affected in this incident.

Within that subset, any review must account for both exposed private keys and stolen signing authority. A user whose key material appears intact may still face asset exposure if an attacker acquired authority to authorize transactions.

The finding does not establish that Google or Apple accounts themselves were compromised. It also does not show that every Web3Auth deployment, social-login provider or Keplr wallet shared the same weakness.

Why the two dollar figures must remain separate

The $1 million figure represents the minimum value GoPlus attributed to assets stolen from the affected Keplr wallets. Because GoPlus described that figure as a minimum, the final loss may be higher as the incident investigation expands.

About $6 million moved to an official rescue address during a separate action. That amount is roughly six times the published theft floor, but the two numbers describe different asset movements and should not be added together, netted against each other or presented as a single total.

The findings do not provide wallet addresses, transaction hashes, individual balances or confirmation that the full rescue-address transfer reached users. The available evidence establishes a transfer to the official address, not the final disposition of every asset sent there.

Operational consequences for providers

For Keplr and Web3Auth, the incident places social-login onboarding, key protection and transaction authorization inside the same assurance review. The affected users drew on multiple identities and wallet types, which complicates any response based solely on wallet software or account balances.

A useful remediation disclosure would need to identify the precise control failure, explain how exposed keys and stolen signing authority arose, and specify whether either condition persists in affected accounts. The current findings do not disclose the vulnerable code path or a technical patch.

No court filing, regulator or law-enforcement action appears in the GoPlus findings. The matter remains a reported security incident and asset-loss event rather than an announced enforcement case.

No remediation deadline or enforcement window appears in the current findings. The next verifiable checkpoint would be a Keplr or Web3Auth disclosure defining the affected wallet set, explaining the control failure and stating whether the roughly $6 million rescue transfer reached users.