Web3Auth flaw leaks Keplr private keys for Google and Apple logins: some zero balances are rescue transfers, not theft

What happened, in order

Web3Auth runs the login layer that lets a wallet create keys from a Google or Apple account instead of a written seed phrase. Its public status page shows the Login Service in maintenance "due to a security incident" from November 6 at 18:30 UTC to November 7 at 18:30 UTC. That is 02:30 SGT on November 7 to 02:30 SGT on November 8. The status note says Web3Auth was "taking precautionary measures" and would post an update when the service came back.

The UTC stamps behind the SGT column: PANews published the Keplr item at 03:14 UTC and the Web3Auth item at 06:30 UTC; Odaily at 03:13 and 06:29 UTC; ChainCatcher at 03:30 and 06:39 UTC.

What Keplr told users

Keplr's update, as reported by PANews, says the leak came from "a Web3Auth infrastructure vulnerability" and affected "some users who logged in via Google or Apple social login." ChainCatcher adds the line that sorts users into two groups: wallets created with a seed phrase or a hardware wallet are not affected.

The rest of the update is instructions:

• If your Keplr account was created with Google or Apple, stop sending new funds to it.
• Move your remaining liquid assets to an account created with a seed phrase or a hardware wallet.
• Some Google or Apple accounts may already show a lower or empty balance because of the protective measures.
• Staked and locked assets take longer to handle because the process is more complex.
• Trust only updates from Keplr's and Web3Auth's official accounts, and ignore direct messages or links that offer asset recovery.

Odaily's report of the same update lists the same points in Chinese. It says Keplr was helping the Web3Auth team protect affected users' assets and that the work was still going on.

Why your balance may show zero

This is the part most likely to cause panic. Web3Auth's second update says it is working with Keplr to transfer assets from affected wallets into secure recovery wallets. Because some of these transfers looked like an attacker draining accounts, it published the verified recovery addresses. They cover Cosmos Hub, Osmosis, Celestia, Akash, Noble, Injective, dYdX, Babylon, Axelar, Saga and Agoric, plus EVM addresses on eight chains, according to Odaily. ChainCatcher carried the same list and the note that Web3Auth would add more addresses as they were verified.

In plain terms: if the private key of your social-login wallet is known to someone else, the first party to move the funds wins. Web3Auth says it is moving them first. An empty balance does not tell you which of the two happened. The outgoing transaction does.

PANews's report on the Web3Auth update repeats the warning: get information only through official channels and watch for impersonators and fake recovery requests.

What to do now if you use Keplr

1. Find out how your wallet was created. If you signed up by tapping "Continue with Google" or "Continue with Apple" and never wrote down a 12- or 24-word phrase, you are in the group Keplr is warning. If you imported a seed phrase or connected a Ledger, Keplr says you are not affected by this flaw.

2. Stop deposits to the social-login address. That includes withdrawals from an exchange. If you have a pending withdrawal from an exchange to a Keplr social-login address that has not been sent yet, cancel it if the exchange allows. Change the saved withdrawal address before your next transfer.

3. Create a new wallet you control with a seed phrase or hardware device. Write the phrase on paper, not in a screenshot or cloud note. Then send the remaining liquid assets from the old account to the new one, network by network. Do a small test transfer first on each chain.

4. Check every outgoing transaction from the old address. Open the block explorer for each network you used (Mintscan for most Cosmos chains, the chain's own explorer for EVM). Compare the receiving address with the verified recovery addresses Web3Auth published through its official account. A match means the transfer was a rescue. A non-match means you should assume theft and keep the transaction hash.

5. Leave staked and locked positions alone until Keplr says how they will be handled. Keplr says these take longer because the process is more complex. Wait for the official procedure instead of trying third-party tools.

6. Ignore every recovery offer. A leaked-key incident brings a wave of fake "support" accounts, cloned sites and DMs asking you to "verify" your wallet or sign a transaction to get funds back. Keplr says to ignore direct messages and links that claim to recover assets. Never type a seed phrase into a website and never sign a transaction a stranger sends you.

Which tokens are involved

The recovery list names the chains where rescue transfers were made. For a trader, that maps to tokens that move on those networks: ATOM (Cosmos Hub), OSMO (Osmosis), TIA (Celestia), AKT (Akash), INJ (Injective), DYDX (dYdX chain), BABY (Babylon), AXL (Axelar), SAGA (Saga) and BLD (Agoric), along with USDC issued on Noble, which many Cosmos users hold as their dollar balance. Nothing in the updates gives a dollar figure for what was exposed or moved, so there is no basis yet to say the incident will force selling in any of them.

Two things are worth watching. First, whether the rescue wallets start returning assets, and how: Web3Auth has not said whether funds go back to the old address (which would be unsafe) or to a new one the owner proves they control. Second, whether any other wallet that uses Web3Auth social login is affected. The reports name only Keplr.

If you hold these tokens on an exchange

An exchange account is a separate system. If your ATOM, TIA or INJ sits on an exchange and you never moved it to a Keplr social-login wallet, this incident did not touch your keys. The risk for exchange users is narrower: a saved withdrawal address that points to an affected Keplr account. Replace it before the next withdrawal, and expect more phishing emails that use the Keplr name.

How this differs from an exchange hack

In the Binance hot-wallet case covered on our news desk, funds left an exchange's own wallets. Here no exchange was breached. The weak point was the login service that generated keys for individual self-custody wallets. That means no exchange freeze or compensation process applies, and the only parties who can move funds safely are the key holders: the user, and now the rescue effort. Whoever moves first matters, which is why the advice is to move remaining assets quickly.

What we could not confirm

• The total value exposed or moved. Neither Keplr's nor Web3Auth's update, as reported, gives a figure.
• How many accounts are affected.
• How recovered assets will be returned and what proof of ownership will be required.
• Whether other applications that use Web3Auth social login are affected.
• The text of Web3Auth's and Keplr's original posts on X, which we did not open this run; the facts above come from the Web3Auth status page and the PANews, Odaily and ChainCatcher reports of those posts.

Quick answers

Is my Keplr wallet affected? Only if you created it with a Google or Apple social login, according to Keplr. Wallets made from a seed phrase or a hardware device are not affected by this flaw.

My balance is zero. Was I robbed? Not necessarily. Web3Auth says it moved assets from affected wallets into recovery wallets and published the verified recovery addresses. Check the receiving address of the outgoing transaction against that list.

What about my staked ATOM or TIA? Keplr says staked and locked assets take longer to handle. Wait for its official instructions and do not use third-party "unstaking" or recovery tools.

Someone messaged me offering to recover my funds. Is that real? Treat it as a scam. Keplr told users to ignore DMs and links claiming to recover assets and to trust only official Keplr and Web3Auth accounts.