Keplr Wallet and Web3Auth Investigate Unauthorized Social Login Transactions

The popular interchain wallet Keplr has reported a security incident involving unauthorized transactions affecting users who utilized social login features. The vulnerability appears to stem from Web3Auth, an infrastructure provider that facilitates non-custodial logins via platforms like Google and Apple. While the full extent of the exploit is still being determined, service providers have moved to suspend affected functions to prevent further asset loss across the Cosmos ecosystem and other integrated networks.

Vulnerability in Embedded Wallet Infrastructure

According to an official statement released on November 7, 2024, Web3Auth confirmed that its service encountered a security breach impacting several third-party platforms that integrate its embedded wallet solutions. In response to the detection of suspicious activity, Web3Auth has suspended its embedded wallet services indefinitely while a comprehensive forensic analysis is conducted. Embedded wallets allow users to interact with decentralized applications without managing traditional private keys manually.

Preliminary findings from the investigation suggest the following:

• The issue is localized to accounts created via Google or Apple login credentials.
• Internal audits indicate that MetaMask users have not been affected by this specific vulnerability.
• Platforms utilizing Web3Auth's social authentication layer are currently the primary focus of the security review.

Impact on Keplr Wallet Users

Keplr Wallet, a leading gateway for the IBC (Inter-Blockchain Communication) protocol, confirmed it received multiple reports of unauthorized fund movements. The development team clarified that the security of the wallet architecture itself remains intact for the majority of its user base. Specifically, accounts secured by 12 or 24-word seed phrases or hardware wallets (such as Ledger) are not affected by this exploit.

The vulnerability is strictly limited to the Web2-to-Web3 bridging mechanism provided by Web3Auth. Keplr and Web3Auth are currently collaborating to identify the root cause of the unauthorized access. Social logins rely on OAuth providers and Multi-Party Computation (MPC) to manage shards of a user's private key.

Security Recommendations and Next Steps

In light of the ongoing investigation, Keplr has issued an urgent advisory to its community. Users who registered their wallets using social media accounts are urged to exercise extreme caution.

During the investigation period, please do not transfer new funds to affected accounts and refrain from interacting with decentralized applications using social login credentials until an official all-clear is provided.

As the cryptocurrency industry continues to bridge the gap between traditional web services and blockchain technology, this incident highlights the potential risks associated with centralized authentication points. Both Keplr and Web3Auth have pledged to release a detailed post-mortem report once the investigation concludes, outlining the specific technical failure and the steps taken to reimburse or protect affected users.