Keplr Wallet has suspended login options via Google and Apple accounts after a security incident at Web3Auth exposed users’ private keys to outside parties. The exploit resulted in roughly $6.01 million being diverted to two primary collector addresses across November 6-7.
On-chain analytics firm Bitquery tracked around 44,700 unique wallets affected by the theft. The distribution of victim wallets spanned 44,041 addresses across seven Cosmos networks and 7,603 accounts on the Injective network.
The Cosmos Hub network recorded the heaviest losses, with around $3.5 million drained. Beyond Cosmos Hub, unauthorized transactions reportedly targeted user balances on Osmosis, Celestia, Akash, Noble, Babylon, dYdX, and Injective.
What made the theft unfold so rapidly was not merely the draining of ordinary wallet balances, but how the hacker compromised locked assets.
Bypassing the 21-Day Staking Lockup Period
The hacker drained 1.96 million ATOM staked on Cosmos Hub. Under normal operations, withdrawing ATOM coins from the staking system requires account holders to undergo a standard 21-day unbonding period before balances can be transferred to another wallet.
The attacker circumvented the three-week waiting period by leveraging a staking-share tokenization mechanism. This scheme converts claims on locked coins into liquid assets, allowing stolen funds to be transferred immediately without waiting for the unbonding process to complete.
Status of 20% of Accounts and Asset Rescue Efforts
Keplr co-founder Josh Lee emphasized that the breach did not stem from a vulnerability in Keplr’s application code. Lee explained that the incident originated from an infrastructure failure at third-party authentication provider Web3Auth, a Consensys-owned entity that facilitates wallet creation through social media accounts without manual seed phrase management.
Josh Lee estimated that roughly 20% of Keplr accounts registered via Google and Apple were potentially affected by the incident. Nonetheless, Lee added that the attacker had only exploited a small fraction of the total vulnerable accounts.
Web3Auth stated that MetaMask wallet users were not affected by the vulnerability in their system. To rescue user assets still remaining in at-risk addresses, the authentication provider launched a white-hat recovery operation.
The suspension serves as a stark reminder for users: the convenience of creating crypto wallets via social logins carries risks when a third-party authentication gateway suffers a breach. Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
