Keplr social-login wallet incident: Who actually holds your private keys?
If you created your Keplr wallet by clicking “Sign in with Google/Apple,” you should read this.
On November 7, Keplr said it had received reports of unauthorized transfers from some accounts created by signing in with Google or Apple. Web3Auth then confirmed that a security issue in its infrastructure had affected some embedded wallets used by Keplr. In a subsequent statement, Keplr explicitly described it as a “private key leak.”
A few things to distinguish:
1. Keplr wallets created with a seed phrase or hardware wallet are, according to the company, unaffected.
2. Sign-in with Google/Apple has been suspended. Web3Auth said it worked with partners to white-hat transfer funds from vulnerable wallets that had not yet been stolen, using the same route as the attackers. So if some accounts have lower or even zero balances, this may have been a rescue operation—not necessarily a theft. Staked and locked assets take longer to handle.
3. Neither party has yet disclosed the number of affected wallets or the amount of losses.
Official advice for users who may be affected: Don’t transfer any more funds into that account. Move any remaining liquid assets to an account secured with a seed phrase or hardware wallet. Trust only official Keplr and Web3Auth accounts, and treat any links in DMs offering to “help you recover” your funds as phishing.
“Seedless” login saves you the trouble of memorizing 12 words, not the risk—the key is simply stored somewhere else. Before using social login, ask: Who generates the private key, where is it stored, and who can access it if something goes wrong?
#Keplr #钱包安全 #Web3