Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety

An attacker exploited a security flaw at Web3Auth, the company that runs Google and Apple sign-in for the Keplr crypto wallet, to reach some users' wallets and steal funds, with GoPlus estimating at least about $1 million stolen. Web3Auth says it used the attacker’s own route to empty other at-risk wallets into recovery wallets for safekeeping, with Bitquery counting at least $6.01 million moved from more than 44,000 wallets, and Google and Apple sign-in has been paused while the incident is investigated.