🔑 Wallets created with one-tap Google/Apple login—are their private keys really safe? Keplr social login wallets drained en masse
📌 What happened
• Starting on the evening of November 6, wallets created on Keplr using Google / Apple login were drained one after another. Its login service provider, Web3Auth, later confirmed a security issue in its infrastructure, and Keplr said some users' private keys had been exposed
• On-chain analytics firm Bitquery counted at least 44,041 wallets drained. Two recipient addresses held a combined total of about $6.01 million, including about $3.5 million on Cosmos Hub. In addition, about 7,603 wallets on Injective were drained
• A Keplr co-founder said about 20% of social login accounts were affected, but only some had been exploited
• Accounts created with a recovery phrase or hardware wallet were reportedly unaffected. Web3Auth's preliminary investigation has not found any affected MetaMask users
🔍 Details worth noting
• The attackers converted staked ATOM into share tokens and transferred them out, bypassing the 21-day unbonding period. About 1.96 million staked ATOM were moved
• Bitquery said 86% of the affected wallets were drained only after Keplr issued its warning—pausing logins can't stop someone who already has the private keys
• Web3Auth said some balance reductions were “white-hat protective transfers,” so a zero balance does not necessarily mean the funds were stolen
📊 Market impact
This is a custody architecture risk affecting “social login wallets,” not all wallets—and certainly not exchange accounts. ATOM is currently around $1.36 (24h: -1.5%), having fallen from $1.67 over the past two weeks.
• Support: around $1.34–1.35 (tested several times recently)
• Resistance: $1.40, then $1.47–1.55
The news is somewhat bearish, but the price is already near its lowest range in the past two weeks.
⚠️ What to do: If you created your Keplr account using Google/Apple login, don't transfer any more funds into it. Move your remaining assets to an account created with a recovery phrase or hardware wallet. Don't click any direct-message links claiming they can “help you recover” your funds.
Was your wallet created with social login, or did you write down your recovery phrase yourself? Is the convenience of one-tap login worth this risk? Share your thoughts in the comments 👇
👉 Trade ATOM: https://www.binance.com/zh-CN/trade/ATOM_USDT
#Keplr建议社交登录用户转移资产 #Keplr #Web3Auth #ATOM #WalletSecurity
⚠️ This is not investment advice. Please be aware of the risks.