Keplr Wallet warns some users who logged in via Google or Apple to transfer their remaining assets; users with mnemonic phrases and hardware wallets are not affected.

Keplr Wallet announced that a vulnerability in the Web3Auth infrastructure has led to private key leaks for some Keplr users who logged in via Google or Apple. Users who created wallets using mnemonic phrases or hardware wallets are not affected. Keplr is assisting Web3Auth in protecting the assets of affected users, with related work still underway. The handling of staked and locked assets is more complex and will take longer. Some accounts that logged in via Google or Apple may have seen their balances reduced or emptied due to the aforementioned risk mitigation measures. Keplr warned that users who created accounts via Google or Apple may be affected, and should stop transferring new funds to these accounts and move remaining liquid assets to accounts created using mnemonic phrases or hardware wallets. The two parties are developing a method for users to check if their accounts are affected. Users should only trust updates from Keplr and Web3Auth’s official accounts, and ignore direct messages and links claiming to “recover assets.”