GoPlus Links Web3Auth Flaw to at Least $1 Million in Keplr Theft

GoPlus has identified a security weakness in Web3Auth tied to theft of at least $1 million from Keplr wallets set up through Google or Apple sign-in. GoPlus connected the incident to Web3Auth, the social-login service used during setup of the affected wallets. The compromise involved exposed private keys in some cases and stolen authority to sign transactions in others. At least $1 million in assets was stolen. About $6 million in assets was also transferred to an official rescue address, a separate movement in the incident. Keplr wallets made using Google or Apple sign-in were identified as affected.