⚠️UPDATE: Web3Auth debunks the circulating $6.01 MILLION Keplr theft reports, saying the addresses Bitquery traced are VERIFIED recovery wallets. Bitquery initially flagged the transfers as suspected theft after a Web3Auth breach exposed private keys for some Keplr wallets. Web3Auth says it moved the funds with Keplr’s help to PROTECT users’ assets. The confirmed loss total remains UNKNOWN. Keplr recently PAUSED Google and Apple logins after reports of unauthorized transactions. Keplr warned some wallets created with either login may be AFFECTED. Yet, Keplr assured wallets created with a recovery phrase or hardware wallet were UNAFFECTED. Web3Auth warned users to ignore DMs offering to recover funds and published these verified recovery addresses.

We’re aware of a security issue affecting Web3Auth’s services used by some third parties. We have temporarily paused the embedded wallet service. After an initial investigation, we’ve found no evidence that MetaMask users are impacted.

CZ Has a Warning For Millions Using Social Login Wallets Binance (@binance) founder Changpeng Zhao (@cz_binance) has urged crypto users to review social login wallet security. "Self custody = self responsibility," he noted. His warning follows Web3Auth's disclosure of a security issue affecting services used by third parties. Web3Auth has temporarily paused its embedded wallet service.

🚨 Some Keplr wallets have been affected by a security incident. Google and Apple login options have been temporarily disabled. According to Keplr, a vulnerability in Web3Auth’s infrastructure exposed private keys for some wallets created using Google or Apple login. Wallets created with a recovery phrase or hardware wallet were not affected. Bitquery traced approximately $6.01 million in related asset transfers. However, Web3Auth is also conducting whitehat recovery operations to secure funds, so these transfers cannot all be classified as theft. The final loss total remains unconfirmed. Keplr urges affected users to stop sending funds to their original wallets, move any remaining withdrawable assets to a newly created recovery-phrase wallet or hardware wallet, and ignore unsolicited messages or links claiming to offer “asset recovery.” The investigation and efforts to secure assets are ongoing. Reduced or empty balances in some accounts may also reflect protective transfers and require further verification. #Keplr# #Web3Auth# #CryptoSecurity# #Cosmos#

⚠️ALERT: Crypto wallets created with Google or Apple logins are being hit by unauthorized transactions. Keplr, the main wallet of the Cosmos ecosystem, paused both login options after users reported the thefts. The incident originated at Web3Auth, the login service owned by MetaMask's parent Consensys, which says it has gone into "maintenance mode due to a security incident." Web3Auth claimed nearly 50 MILLION users across more than 8,200 apps when Consensys bought it last year, per The Block. Keplr's co-founder estimates about 20% of its Google and Apple login accounts are affected, but says only "a fraction" of those has been exploited and the rest "may be recoverable." Wallets created with a recovery phrase or hardware wallet are NOT affected, and Web3Auth says there is no evidence MetaMask users are impacted.