Keplr Wallet: Private keys of some social login accounts leaked; users advised to transfer remaining assets

Keplr Wallet has issued a statement confirming a security vulnerability in the Web3Auth infrastructure, which exposed the private keys of some users who created wallets using Google or Apple account logins. Users who created wallets via mnemonic phrases or hardware wallets were not affected by this incident. Keplr is currently working closely with Web3Auth on an emergency response to safeguard affected users’ assets; remediation efforts remain ongoing.

Because staked and locked assets involve more complex on-chain mechanisms and smart contract logic, their recovery and protection processes take longer. To mitigate risk, temporary balance adjustments have been applied to certain Google- and Apple-login accounts—causing user interface balances to appear reduced or even zeroed out.

Keplr urges all users who registered via Google or Apple login to treat their accounts as potentially compromised: immediately halt deposits into such accounts, and promptly transfer any accessible liquid assets to a secure wallet created via mnemonic phrase or hardware wallet.