Web3Auth flaw compromises Keplr wallets created with Google or Apple

Keplr suspended connections through Google and Apple on Saturday after suspicious transactions were discovered on wallets created with these services. The flaw comes from Web3Auth, the provider responsible for generating and managing private keys. Approximately 44,700 keys were exposed.

Keplr closes the door to Google and Apple connections

On November 7, Keplr alerted its users after detecting unauthorized transactions on accounts created with Google or Apple. The platform immediately suspends these two login methods and recommends users not to transfer funds, not to re-import their accounts and to be wary of so-called recovery messages.

The alert comes a few hours after a decision by Web3Auth. On November 6 at 9:13 p.m. UTC, the provider suspended its in-app wallet service following a security incident. The company, which is owned by Consensys, specifies, however, that no MetaMask users are affected.

For his part, Josh Lee, co-founder of Chainapsis, the company behind Keplr, dismisses the hypothesis of an internal flaw. According to him, the problem comes directly from Web3Auth and affects around 20% of accounts connected via social networks.

The distinction is important: users who created their wallet with a recovery phrase or a hardware wallet are not affected. In contrast, those who log in with Google or Apple rely on an external mechanism to reconstruct their private key. In other words, their security also relies on that of their service provider. Comfort sometimes has a price.

Six million dollars moved, it’s not all gone

According to Bitquery’s on-chain analysis, approximately $6.01 million circulated between November 6 and 7. The moves involve several networks, including Cosmos Hub, Osmosis, Celestia, Akash, Noble, dYdX, Babylon and Injective.

Cosmos Hub comes out on top with nearly $3.50 million in transfers. Osmosis follows with 1.04 million, ahead of Injective and its 615,000 dollars.

However, these 6 million do not necessarily correspond to stolen funds. On Sunday, Web3Auth communicated twelve recovery addresses containing assets protected for Keplr users. Their balance reaches approximately $5.6 million, or 93.2% of the flows recorded by Bitquery.

The difference reveals a net loss estimated at $410,000. Be careful, however: this calculation remains approximate, because the two analyzes do not cover exactly the same perimeters or the same periods. Web3Auth also disputes the overall amount.

Bitquery also has approximately 44,700 distinct private keys. The median loss per wallet is just $1.34, even though the largest transfer approaches $325,000. More worryingly, 86% of affected wallets across seven networks recorded movements after Keplr’s alert.

Finally, nearly 1.96 million staked ATOMs also changed position without waiting for the usual release period of 21 days, thanks to liquid staking.

A rescue operation that raises questions

The recovery of funds has not simplified the situation. Web3Auth explains having organized relief operations by borrowing the same mechanism used by the attacker.

Result: for several hours, some users saw their assets leave their wallet without knowing whether it was a theft or a recovery operation. It’s difficult to keep your cool when your cryptos leave without warning.

This method above all reveals a structural weakness. Web3Auth retains the ability to sign transactions on behalf of its users, including during a security crisis. Recovery therefore largely depends on the speed and coordination of the technical teams.

For the moment, neither Web3Auth nor Keplr have communicated a precise timetable for restoring social connections or compensating victims.

The case recalls a fundamental rule of the crypto ecosystem: controlling your assets also implies controlling your keys. Because when a service provider encounters a problem, the promise of the non-custodial wallet can quickly lose its substance. As other cases related to key custody and control of funds show, ease of use does not always guarantee independence.