The team of the non-custodial crypto wallet Keplr has recorded a series of reports of unauthorized transactions in individual accounts created via Google or Apple authorization. The incident affects specifically those addresses where key generation relied on social login rather than a classic seed phrase or hardware device.
The developers have already launched an internal investigation and are conducting it jointly with the Web3Auth team — the provider that supplies the login mechanics through third-party services. According to a preliminary assessment, wallets created using a seed phrase or connected to a hardware storage are not at risk: their keys are generated and stored locally, outside the social authorization infrastructure.
What measures have been taken
As a protective measure, Keplr has temporarily suspended authorization via Google and Apple. Users of such accounts are advised to refrain from topping up their balance, as well as not to import or recreate these wallets until official clarifications appear. The team promised to publish confirmed information and further instructions after the completion of the review.
The situation highlights the fundamental trade-off built into the architecture of social login: the convenience of seamless authorization is achieved at the cost of additional intermediaries in the key generation chain. Any failure or vulnerability on the side of such a provider potentially expands the attack surface for users' funds.
Until the investigation is completed, holders of Keplr wallets with social authorization should remain vigilant and monitor the team's official channels. For other categories of accounts — based on a seed phrase and hardware wallets — the threat has not been confirmed at this time.
Cryptalist analysis: The incident at Keplr once again brings to the fore the question of the resilience of account abstraction models, where security depends on third-party authorization providers. The non-custodial wallet market will be forced to strengthen the audit of such integrations, and users — to reconsider the balance between the convenience of social login and self-control over private keys. For the Web3Auth segment and similar solutions, this is a signal of the need for more transparent security guarantees at the infrastructure level.