BitsLab
Verified account This account is verified. Learn more@0xbitslab
162 Following 6.5K Followers 404 Posts
Latest posts 5
【🚨Security Alert】Keplr Social Login Key Leak & Web3Auth Incident
An infrastructure vulnerability at Web3Auth led to private key exposure for certain Keplr embedded wallets created via Google/Apple social logins. On Nov 7, Keplr suspended social login functionality.
💸 Impact: ~44k Cosmos and 7.6k Injective addresses affected.~$6.01M in on-chain asset migration observed. ~1.96M staked ATOM were converted via the Liquid Staking Module (LSM) to bypass the 21-day unbonding period.
🧲 Status: On Nov 8, Web3Auth confirmed that part of the migrated funds belong to white-hat recovery wallets; exact theft amount is still pending.
⛵️ Root Cause: Issue originated in Web3Auth's third-party key management infrastructure, not Keplr smart contracts. Exact exploit vector remains under investigation.
🧰 Action Required: If you use social logins on Keplr, check your account, avoid further deposits, and migrate remaining assets to a new mnemonic or hardware wallet. Seed-phrase and hardware wallets are not affected. Watch out for phishing recovery links.
BitsLab Security Takeaway:
Wallet security extends beyond smart-contract audits. Third-party auth, key management, and signing infrastructure are critical attack surfaces. BitsLab recommends auditing the entire wallet security stack.
An infrastructure vulnerability at Web3Auth led to private key exposure for certain Keplr embedded wallets created via Google/Apple social logins. On Nov 7, Keplr suspended social login functionality.
💸 Impact: ~44k Cosmos and 7.6k Injective addresses affected.~$6.01M in on-chain asset migration observed. ~1.96M staked ATOM were converted via the Liquid Staking Module (LSM) to bypass the 21-day unbonding period.
🧲 Status: On Nov 8, Web3Auth confirmed that part of the migrated funds belong to white-hat recovery wallets; exact theft amount is still pending.
⛵️ Root Cause: Issue originated in Web3Auth's third-party key management infrastructure, not Keplr smart contracts. Exact exploit vector remains under investigation.
🧰 Action Required: If you use social logins on Keplr, check your account, avoid further deposits, and migrate remaining assets to a new mnemonic or hardware wallet. Seed-phrase and hardware wallets are not affected. Watch out for phishing recovery links.
BitsLab Security Takeaway:
Wallet security extends beyond smart-contract audits. Third-party auth, key management, and signing infrastructure are critical attack surfaces. BitsLab recommends auditing the entire wallet security stack.
