Web3Auth flaw exploited to steal Keplr wallet funds

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Keplr users who signed in with Google or Apple

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover

The Brief

Some Keplr wallet users who set up wallets with Google or Apple sign-in had money stolen by an attacker.
Keplr uses Web3Auth to run that Google and Apple sign-in, and the attacker used a security flaw at Web3Auth to reach the wallets.
According to the article headline, Web3Auth emptied other wallets for safety.

Why it matters

Wallets that depend on third-party social login can be compromised through that provider's flaw, so developers relying on external authentication services should review that dependency.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	Judgment: Web3Auth is a developer-integrated auth service that wallet apps build on, so developers are affected.
No	Core infrastructure	Judgment: a single vendor's auth service used by one wallet, not software nearly every team runs.
No	Popular tool	Judgment: Web3Auth is a niche Web3 auth provider, not a mainstream framework, OS or package.
Yes	Exploited in the wild	The Hacker News: some users had money stolen by an attacker who used the Web3Auth flaw.
No	Public exploit	The Hacker News snippet does not say exploit code or a proof-of-concept was published.
No	Remote, no login	The Hacker News snippet does not say whether the attack needed credentials or user interaction.
Yes	Full takeover	The Hacker News: the attacker used the Web3Auth flaw to reach the wallets and steal funds, implying account takeover.
No	Secrets exposed	The Hacker News reports stolen funds; it does not say credentials, keys or configs were exposed.
No	Supply chain	The Hacker News describes a security flaw exploited, not malicious code shipped through a trusted channel.
No	No fix yet	The Hacker News snippet does not say whether a patched version is available or unavailable.

Source

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety ↗ The Hacker News · 3h ago

First seen 3h ago · 1 source · Full story page · How tiers are decided