GoPlus: Keplr Wallet Exposed Some Users' Private Keys Due to Web3Auth Vulnerability, At Least Approximately 1000000 USD in Assets Stolen
BIBIBI
AT A GLANCE
GoPlus states that the Web3Auth vulnerability affected some Keplr wallets created via social login, with at least approximately 1000000 USD in assets stolen.
Article
GoPlus: Keplr Wallet Exposed Some Users' Private Keys Due to Web3Auth Vulnerability, At Least Approximately 1000000 USD in Assets Stolen
PANews November 9 report, according to GoPlus monitoring and analysis, the Keplr wallet suffered a vulnerability in social login service provider Web3Auth, resulting in some users' private keys being leaked or transaction signing capabilities being stolen, with at least approximately 1000000 USD in assets stolen, and an additional approximately 6000000 USD in assets transferred to an officially confirmed rescue address. The affected users in this incident are those who created Keplr wallet addresses using Google or Apple login; mnemonic phrase wallet and hardware wallet users are not affected.
PANews published this report on November 9 citing GoPlus monitoring and analysis.
02
GoPlus states that the Keplr wallet suffered a Web3Auth vulnerability, resulting in some users' private keys being leaked or transaction signing capabilities being stolen.
03
GoPlus states that at least approximately 1000000 USD in assets were stolen.
04
An additional approximately 6000000 USD in assets were transferred to an officially confirmed rescue address.
05
Affected users created Keplr wallet addresses using Google or Apple login.
06
Mnemonic phrase wallet and hardware wallet users are not affected.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Private keys or transaction signing capabilities can be used to control wallet assets. The original report states that the risk is concentrated in some Keplr wallets created via Google or Apple social login; users of mnemonic phrase wallets or hardware wallets are not affected.
Why it matters to readers
The original report describes the situation of assets being stolen and funds being transferred to a rescue address, indicating that some related wallets have already faced actual asset security risks.
If your Keplr wallet was created via Google or Apple login, you should pay attention to relevant security notices; if you use a mnemonic phrase wallet or hardware wallet, the original report states you are not affected.
Risks and unknowns
The current evidence is PANews's relay of GoPlus monitoring and analysis, and does not include a complete official technical bulletin from Keplr or Web3Auth.
The original report does not explain the vulnerability details, remediation status, or the full scope of impact.
The status and disposition of the approximately 6000000 USD transferred to the rescue address have not been explained.
The original report does not state whether there are new victims or compensation arrangements.
Related Developments
Loading event timeline…
Related concepts
Private key
This term is not in the glossary yet. Browse related concepts in the glossary.
