- After a vulnerability in Web3Auth, Consensys’ login service, funds flowed out of over PLN 44,000. Keplr wallets established by Google or Apple. Wallets with the recovery phrase and hardware wallets were not affected by the incident.
- According to Web3Auth, these transfers are a rescue operation: the company moved funds from vulnerable wallets before the attacker did so. Her 12 addresses have approximately USD 5.6 million.
- It is not known how much the attacker took over. There is no deadline for the refund yet.
With over 44 thousand Keplr wallets, which users set up via a Google or Apple account, saw funds flow out in less than a day. According to Web3Auth, the company handling this login, the transfers did not go to the hacker: after detecting the vulnerability, it moved money itself from vulnerable wallets before the attacker did it.
What happened to Keplr wallets
Lee estimates that the problem affected about 20% of Keplr accounts set up by Google or Apple. He added that only some of them were actually used. Web3Auth found no evidence that the incident affected MetaMask users.
How much money was transferred
Web3Auth said on Saturday it was moving funds from affected wallets. On Sunday, she published the 12 addresses to which she transfers them. According to The Block, there is approximately USD 5.6 million in them. The largest position is approximately 2.49 million ATOM, a token of the Cosmos Hub network, worth approximately USD 3.3 million.
Bitquery counted 44,041 wallets across seven Cosmos networks, from which funds went to Web3Auth addresses. As of Saturday, November 7, 4:38 p.m. Polish time. The median transfer from one wallet was USD 1.34, and all Bitquery transfers were valued at USD 6.01 million. On the Injective network, funds were withdrawn from 7,603 wallets, but according to Bitquery, these were mostly the same users. In total, it is about 44.7 thousand. wallets.
Bitquery first described these transfers as theft. Improved analysis when Web3Auth and Keplr showed receiving addresses as rescues. None of the companies disclosed how much funds the attacker took over and how many wallets.
What does this mean to you
If you set up Keplr through Google or Apple, Keplr recommends:
- Do not deposit new funds to this address.
- Transfer what you can withdraw to your recovery phrase wallet or hardware wallet.
- Do not import the exposed wallet into another application.
- Ignore messages with “recovery” links. Search for information only on the official Keplr and Web3Auth channels.
Keplr has stopped Google and Apple logins, and Web3Auth has stopped creating wallets via external logins. If your balance has dropped to zero, check your transaction history for the recipient’s address. Compare it with the list of 12 addresses that Web3Auth published on its X account. If the address is on the list, the funds were taken by a rescue operation and according to Web3Auth they will be refunded.
You won’t always transfer funds in staking immediately, because in Cosmos Hub, unlocking takes 21 days. Web3Auth has not yet announced the date or method of return. Keplr, together with Web3Auth, is preparing a tool where you can check whether the incident affected your wallet.
