Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker.

Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week.

Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, it said. It moved that money, with help from the wallet maker, into recovery wallets for safekeeping. So an empty balance may mean the money was rescued, not stolen.

Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected, the wallet maker said. It has paused Google and Apple sign-in while it investigates.

The wallet maker has given this user guidance for accounts created with Google or Apple login:

Staked and locked assets are taking longer to secure. The wallet maker is also working with the login provider on a way for users to check whether their account was affected.

In the meantime, the login provider has published a recovery address list, which it says lets people tell its own transfers apart from possibly malicious ones.

It has also warned users not to assume that an unfamiliar destination address is linked to the attacker.

In an incident update , Web3Auth said a security issue in its own infrastructure affected certain wallets it provides inside the Keplr app.

Source link