Web3Auth moved funds from vulnerable Keplr wallets the attacker hadn’t accessed to recovery addresses; Keplr advised users to transfer their remaining assets to another wallet.
The 12 addresses Web3Auth disclosed for recovery held approximately $5.6 million worth of cryptocurrency at the time of publication on Sunday. On-chain data reviewed by The Block showed this amount, while Web3Auth said it moved the funds from wallets the attacker had not yet accessed.
The issue stemmed from a flaw in Web3Auth’s systems that exposed the private keys of some users who logged in to Keplr using their Google or Apple accounts. Keplr co-founder Josh Lee said approximately 20% of accounts may have been affected, but noted that only some of those accounts were attacked. According to Keplr, users who used a recovery phrase or hardware wallet were not affected.
Keplr warned users who logged in with Google and Apple
Keplr advised users who logged in with Google or Apple not to send new funds to their accounts and to move their remaining assets to another wallet secured with a recovery phrase or hardware wallet. The company is working with Web3Auth to help users check whether their accounts were affected. In some accounts, balances may appear reduced or zero because funds were moved during the response.
Web3Auth said it began the recovery process on Saturday and that the transferred funds were safe. Most of the recovered assets were 2.49 million ATOM on the Cosmos Hub network, worth approximately $3.3 million. A significant portion of the ATOM was staked. To transfer these assets quickly, they were converted into tokens that did not require waiting out the network’s 21-day unbonding period.
Web3Auth disclosed the vulnerability on Friday and paused its service that enables wallet creation through social media accounts. The company reported that it had found no evidence that users of Consensys’s other wallet, MetaMask, were affected.
Not investment advice.