Keplr: Unauthorized transactions affect wallets created via Google or Apple

Unauthorized transactions and funds moved as a precaution. Keplr suspended connections through Google and Apple on November 7 after reports of unauthorized transactions. The incident concerns wallets created with the Web3Auth authentication service. At the same time, the teams have secured funds. Bitquery has traced approximately $6 million to recovery addresses, while the amount actually stolen remains unknown.

The key points of this article

Keplr suspended Google and Apple connections after an incident with its provider Web3Auth.

Bitquery identified approximately 44,700 distinct wallets in its security transfer analysis.

The $6.01 million identified by Bitquery corresponds to funds directed to recovery addresses identified by Web3Auth.

According to Keplr, wallets created with a recovery phrase or linked to a hardware device fall outside the scope of the incident.

The incident affects wallets created via Google or Apple

Keplr offers its users to create a wallet from a Google or Apple account. This option is based on Web3Auth, a service provider that allows you to configure a wallet without having to manage a recovery phrase when creating it. After initial reports, Web3Auth suspended its in-app wallets service and Keplr disabled both affected login methods.

Josh Lee, co-founder of Keplr, places the origin of the incident in Web3Auth's infrastructure. According to its preliminary estimate, around 20% of Keplr accounts created through Google or Apple may have been exposed. He estimates that only a fraction of these accounts have suffered malicious operations.

Why an empty balance can correspond to sheltering

Web3Auth and Keplr transferred assets to secure wallets to keep them away from the attacker. Bitquery initially interpreted these movements as theft. The company revised its analysis after publishing the list of recovery addresses on November 8. These held approximately $6.01 million at the time of Bitquery's November 7 statement.

Keplr asks affected users to no longer fund these wallets. Those who still have access can, as directed by the team, move their available assets to a wallet created with a recovery phrase or hardware device. Assets that are blocked or staked take longer to process.