Ethical Hacking News
Web3Auth flaw exploited to steal Keplr crypto funds and empty wallets, with at least $6.01 million in funds moved into recovery wallets. The incident highlights the need for robust security measures in the digital wallet space.
Web3Auth security flaw exploited to steal $6.01 million in cryptocurrency funds from Keplr wallets. Attacker used security issue in Web3Auth infrastructure to access and drain funds from linked Google or Apple accounts. Wallet maker provides guidance to affected users to prevent further losses. Pause of embedded wallet service and return of funds to users. Need for robust security measures in the digital wallet space highlighted by the incident.
The cryptocurrency market is known for its volatility and the risk of security breaches that can lead to significant financial losses. Recently, a Web3Auth flaw has been exploited to steal Keplr crypto users' funds and empty their wallets for safety. This security breach has raised concerns among cryptocurrency enthusiasts and users, highlighting the need for robust security measures in the digital wallet space.
According to a recent report by The Hacker News, a security flaw in the Web3Auth system was exploited by an attacker to access and drain the funds from Keplr wallets that were linked to Google or Apple accounts. The attacker was able to take advantage of this flaw due to a security issue in the Web3Auth infrastructure.
The Web3Auth company, which provides a Google and Apple sign-in service for Keplr wallets, admitted that a security flaw in its own infrastructure had allowed the attacker to gain unauthorized access to certain wallets. The attacker used this flaw to move funds from at-risk wallets into recovery wallets, where they could be safely stored.
The impact of this security breach was significant, with at least $6.01 million in funds being moved into recovery wallets by the blockchain data firm, Bitquery. Another firm, GoPlus, estimated that the attacker had stolen at least $1 million in funds.
To mitigate the impact of this security breach, the wallet maker has provided guidance to affected users, recommending that they do not send new funds to affected accounts, do not re-import the account, and move any funds that are not staked or locked into accounts that use a recovery phrase or a hardware wallet.
The wallet maker has also paused its embedded wallet service, which is used by some other companies, and is working with the login provider to return the funds to the users.
The incident highlights the need for robust security measures in the digital wallet space. The Web3Auth flaw is a reminder that security vulnerabilities can exist in even the most seemingly secure systems.
The incident also raises questions about the effectiveness of the current security measures in place to protect cryptocurrency users. The fact that the attacker was able to exploit a security flaw in the Web3Auth infrastructure to access and drain funds from Keplr wallets suggests that there may be weaknesses in the system that need to be addressed.
In addition, the fact that the wallet maker and the login provider were able to respond quickly to the incident and take steps to mitigate the impact suggests that there may be a need for more robust security measures in place to prevent similar incidents in the future.
The incident has also raised concerns about the impact on other companies that use the Web3Auth service. The wallet maker has stated that the issue affects its services used by some other companies, but it has not specified which companies are affected.
In conclusion, the exploitation of the Web3Auth flaw has highlighted the need for robust security measures in the digital wallet space. The incident has raised concerns about the effectiveness of current security measures and has highlighted the need for more robust security measures to prevent similar incidents in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploitation-of-Web3Auth-Flaw-Exposes-Keplr-Crypto-Users-to-Stealing-and-Emptying-of-Wallets-ehn.shtml
https://thehackernews.com/2026/11/web3auth-flaw-exploited-to-steal-keplr.html
Published: Mon Nov 9 06:44:55 2026 by llama3.2 3B Q4_K_M
