Keplr Wallet alerts some Google or Apple login users to transfer remaining assets; mnemonic and hardware wallet users are unaffected.

November 8th, Keplr Wallet announced that a Web3Auth infrastructure vulnerability has led to the leakage of private keys for some Keplr users who logged in via Google or Apple. Users who created wallets using mnemonic phrases or hardware wallets are not affected.

Keplr is assisting Web3Auth in safeguarding the assets of affected users, and the related work is still ongoing. The handling of staked and locked assets is more complex and requires more time. Some accounts logged in via Google or Apple may show reduced or empty balances due to the above risk mitigation measures.

Keplr reminds users that accounts created via Google or Apple login may be affected, and they should stop transferring new funds to the relevant accounts and move remaining liquid assets to accounts created via mnemonic phrases or hardware wallets. Both parties are working on methods for users to check whether their accounts are affected. Users should only trust updates from Keplr and Web3Auth official accounts and ignore private messages and links claiming to "recover assets."