Web3Auth Flaw Exposed Keys for Some Keplr Social Logins

Keplr said a vulnerability in Web3Auth infrastructure exposed private keys belonging to some users who created wallet accounts by signing in with Google or Apple. The disclosure did not state how many wallets or assets were affected, identify a date of compromise, or explain the technical root cause.

That uncertainty matters because the affected set is defined by account creation method. Keplr said wallets created with a recovery phrase or hardware wallet were not affected, while social-login wallets tied to Web3Auth infrastructure were at risk. The warning concerns private-key exposure, not merely a compromised login session.

Keplr identified a Web3Auth infrastructure vulnerability; the statement did not allege a failure of Google or Apple sign-in services. It did not include a technical postmortem or explain how authentication interacted with private-key handling. The statement therefore identifies the exposed wallet category, but not the mechanism that produced the exposure.

Which accounts were exposed?

The exposure applied to some wallet accounts created through Google or Apple social login, according to Keplr. For those users, private keys were exposed and assets in the accounts were placed at risk. The source did not provide affected-user counts, balances, chain-level loss data, or separate figures for Google and Apple logins.

Accounts created with a recovery phrase or hardware wallet were outside the reported impact. That exclusion does not mean those accounts require no review; it means Keplr did not identify them as affected by this Web3Auth vulnerability. Keplr operates as a wallet in the Cosmos ecosystem.

The disclosure supports a risk assessment rather than a quantified loss estimate. It does not extend to every wallet in the Cosmos ecosystem or identify any affected chain or token standard. The practical dividing line is the method used to create the wallet.

What should users do now?

Keplr advised users “not to deposit new funds into their original accounts” if they believed the account was affected. It also advised moving any remaining transferable assets to an account created with a recovery phrase or hardware wallet. Those steps separate transferable assets from the potentially affected account, but they do not resolve the status of funds that cannot be transferred immediately.

Keplr warned that some social-login accounts displaying lower or zero balances “may reflect asset protection measures.” A zero balance therefore does not by itself establish that an account is safe or that an account is unaffected. The disclosure did not explain what protections were applied, how those measures affected displayed balances, or whether every affected account received the same treatment.

Users should move transferable assets away from a possibly affected social-login account and avoid adding new funds until its status is clear. The planned screening tool could narrow that uncertainty, but the disclosure provides no publication date for it.

How are Keplr and Web3Auth responding?

Keplr said it is working with Web3Auth to protect assets in affected accounts. The companies are also developing a tool that will help users determine whether their accounts were affected. That screening step matters because the initial warning identifies a category of risk but does not supply a list of affected accounts.

The response is taking longer for staked or locked funds. Keplr did not explain which assets qualify, what interim controls apply, or whether a specific recovery schedule exists. Nor did it provide a publication date for the identification tool. Without those details, users cannot tell from the disclosure when the remediation for every affected account will finish.

The next verifiable checkpoint is release of the joint account-screening tool; no deadline was set, and the remediation window remains open.