Claim: Web3Auth security incident sparks wallet thefts; Keplr pauses social logins
Web3Auth, the login service owned by Consensys (MetaMask's parent), confirmed a security incident and entered maintenance mode. Users of wallets created with Google or Apple logins reported unauthorized transactions; Keplr paused those options, and its co-founder estimates about 20% of such accounts were affected, with only a fraction exploited. Wallets created with a recovery phrase or hardware wallet are not affected, and Web3Auth says there is no evidence MetaMask users are impacted.
What happened
Web3Auth, the login service owned by Consensys (MetaMask's parent), confirmed a security incident and entered maintenance mode. Users of wallets created with Google or Apple logins reported unauthorized transactions and thefts. Keplr, the main wallet of the Cosmos ecosystem, paused both login options.
Why it matters
Web3Auth claimed nearly 50 million users across more than 8,200 apps when Consensys bought it, per The Block. Keplr's co-founder estimates about 20% of the wallet's Google and Apple login accounts are affected, but only a fraction of those has been exploited and the rest may be recoverable. Wallets created with a recovery phrase or hardware wallet are not affected.
What to do
Suspend or closely monitor social logins (Google/Apple) in apps that use Web3Auth. Review transactions on social-login accounts and move users to a recovery phrase or hardware wallet. Track the service's return after maintenance.
For the technical team
- Affected
- Consensys Web3Auth, serviço de login de propriedade da Consensys; carteira Keplr e apps que usam o login afetados · Wallets created with Google or Apple login via Web3Auth; affected Keplr social-login accounts. Web3Auth claims nearly 50 million users across more than 8,200 apps, per The Block. No evidence of impact to MetaMask users, per Web3Auth.
- Exploitation
- Thefts reported by users on social-login wallets; Keplr paused Google and Apple logins after the reports. Keplr's co-founder estimates about 20% of Keplr's Google/Apple accounts are affected, with only a fraction exploited and the rest possibly recoverable.
- Fix
- No fix published; Web3Auth is in maintenance mode due to the security incident. Mitigation underway: Keplr paused Google and Apple logins; unexploited accounts may be recoverable, per the co-founder.
- Vector
- Web3Auth service, social login (Google/Apple) for crypto apps, owned by Consensys. The nature of the flaw is not detailed in the source; the incident results in unauthorized transactions on wallets created with social login. Wallets with a recovery phrase or hardware wallet are not affected.
- More details
- Web3Auth is owned by Consensys, MetaMask's parent; the user count was claimed at the time of the acquisition, per The Block. Keplr is described as the main wallet of the Cosmos ecosystem. The source is an alert from the Coin Bureau account on X.
Timeline
Initial batch: Web3Auth confirms security incident and Keplr users report thefts.
Sources 1 source
- @coinbureau @coinbureau
