Keplr Wallet pauses Google and Apple logins after security issue tied to Web3Auth

Crypto wallet provider Keplr said on X on November 7 that it received reports of unauthorized transactions affecting some accounts that were created using Google or Apple login. Keplr flagged the issue to Web3Auth, the service that handles these social logins, and the two companies are now investigating together. Web3Auth separately confirmed it is aware of a security issue affecting some third-party services that use its embedded wallet technology, and it has temporarily paused that service while it investigates. Web3Auth stated it found no evidence that MetaMask users were affected by the same issue. Keplr clarified that accounts secured with a traditional recovery phrase or a hardware wallet are not affected by this problem, only those created through the social login option. As a precaution, Google and Apple login access on Keplr has been paused entirely. Keplr is advising affected users not to send any new funds to accounts created this way, not to attempt re-importing those accounts, and to ignore any direct messages offering help with account recovery, since these are often scams targeting people whose accounts have already been compromised. As of the announcement, Keplr had not published any total figure for funds lost.

Why it matters

A security issue in third-party login infrastructure shared across multiple crypto wallets raises concerns about how widely the flaw may have spread.

Source: Keplr Wallet