Keplr Wallet Updates on Security Incident: Private Keys Leaked for Some Social Login Accounts, Users Advised to Move Remaining Assets

November 8: Keplr Wallet has posted an update on the security incident, stating that a Web3Auth infrastructure vulnerability led to the leakage of private keys for some users who logged in via Google or Apple social login. It is currently assisting the Web3Auth team in taking measures to protect the assets of affected users, and the handling is still ongoing; staked and locked assets may take longer due to the complexity of processing.

Users who logged in with Google or Apple should temporarily stop transferring new funds into the relevant accounts and move their remaining transferable assets to accounts created via a mnemonic phrase or hardware wallet. Some affected accounts may already show reduced or zero balances as a result of asset protection measures. Users are also reminded to trust only information published by the official Keplr and Web3Auth accounts, and to be wary of direct messages and links impersonating asset recovery services.

Earlier reports noted that unauthorized transactions had occurred in some Keplr Wallet social login accounts, and that the Google/Apple login function has now been suspended.