Keplr Says Recovery Effort May Explain Empty Wallet Balances

Keplr said Nov. 7 that its asset-recovery effort with Web3Auth may already have left some Google- and Apple-login accounts showing a “reduced or empty balance.”

Web3Auth said it and its partners had begun protective transfers from vulnerable wallets that had not yet been hit, “utilizing the same path of the original attacker.” The provider said recovered funds were safe and that some recovery transactions had been mistaken for attacker activity.

The multichain wallet attributed the incident to a vulnerability in Web3Auth’s infrastructure that led to a private-key breach affecting some users who signed in with Google or Apple. Accounts created with a recovery phrase or a hardware wallet are not affected, Keplr said.

Keplr told Google- and Apple-login users not to send new funds to those accounts and to move any remaining liquid assets to a recovery-phrase or hardware-wallet account. It warned users to ignore direct messages or links offering recovery and trust only its own account or Web3Auth’s updates.

Recovery Addresses Still to Come

Web3Auth said it was preparing a verified list of recovery addresses so users and blockchain teams could distinguish legitimate recovery transfers from potentially malicious transactions. That would let users check transfer destinations against addresses confirmed by the provider.

“Please do not assume that an unfamiliar destination address is associated with the attacker,” Web3Auth said.

Keplr said staked and locked assets make the ongoing recovery more complex and take longer. It is also working with Web3Auth on a way for users to check whether their accounts are affected.

The recovery update follows Keplr’s suspension of Google and Apple login after reports of unauthorized transactions. Web3Auth had also paused its embedded wallet service. Keplr’s security documentation says Google-login accounts use Web3Auth to generate a private key rather than a recovery phrase.

Neither team’s recovery update quantified the number of affected accounts or the amounts stolen or secured. Web3Auth said it would provide further details when the recovery operations were complete.