Security · High impactFan score 45 · Tier B
Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
The Hacker News ·
The Brief
- Some Keplr wallet users who set up wallets with Google or Apple sign-in had money stolen by an attacker.
- Keplr uses Web3Auth to run that Google and Apple sign-in, and the attacker used a security flaw at Web3Auth to reach the wallets.
- According to the article headline, Web3Auth emptied other wallets for safety.
Why it matters
Wallets that depend on third-party social login can be compromised through that provider's flaw, so developers relying on external authentication services should review that dependency.
Who’s affected
- Keplr wallet users who signed in with Google or Apple
- Developers integrating Web3Auth
- #web3auth
- #keplr
- #crypto-wallet
- #authentication
- #security-breach
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies…