Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety

Summary: An attacker exploited a security flaw in Web3Auth's infrastructure to reach Keplr crypto wallets created with Google or Apple sign-in, and Keplr said the flaw led to a "private key breach" for some of those users. Web3Auth then used the same route to empty other at-risk wallets into recovery wallets, with Bitquery counting at least $6.01 million moved from more than 44,000 wallets, while GoPlus estimated at least about $1 million stolen.
What's compelling: Keplr co-founder Josh Lee estimated about 20% of Google and Apple login accounts were affected, and neither company has said how the flaw worked or whether that route is now closed - so an empty balance may mean funds were rescued, not stolen, and users have no confirmed way yet to tell which.

Read the original at The Hacker News ↗