Keplr Says Empty Wallet Balances May Be From Recovery Effort
Empty balances may reflect protective transfers
Keplr said on Nov. 7 that some users who signed in with Google or Apple may now see a reduced or empty balance. The company said this may already be caused by an asset-recovery effort with Web3Auth.
A wallet is an app or account used to hold crypto assets. A private key is the secret code that controls a wallet. Keplr said a vulnerability in Web3Auth infrastructure led to a private-key breach for some Google and Apple login users.
What affected users need to know
- Accounts created with a recovery phrase or a hardware wallet are not affected, Keplr said.
- Google and Apple login users were told not to send new funds to those accounts.
- Users were told to move any remaining liquid assets to a recovery-phrase or hardware-wallet account.
- Users were warned to ignore direct messages or links offering recovery and to trust only Keplr or Web3Auth updates.
What Keplr and Web3Auth said happened
Web3Auth said it and its partners had begun protective transfers from vulnerable wallets that had not yet been hit. It said it used the same path as the original attacker. It also said recovered funds were safe and that some recovery transactions had been mistaken for attacker activity.
Keplr said the recovery update follows its suspension of Google and Apple login after reports of unauthorized transactions. Web3Auth had also paused its embedded wallet service, the report said.
Keplr said Google-login accounts use Web3Auth to generate a private key rather than a recovery phrase, according to its security documentation.
Recovery addresses are still being prepared
Web3Auth said it was preparing a verified list of recovery addresses. The list would help users and blockchain teams tell legitimate recovery transfers from potentially malicious transactions.
Web3Auth asked users not to assume that an unfamiliar destination address is linked to the attacker.
What is confirmed and what remains unclear
Keplr and Web3Auth confirmed that a recovery effort had begun and that some balances may be reduced or empty because of it. The cause of the breach was attributed by Keplr to a vulnerability in Web3Auth infrastructure.
Neither team quantified how many accounts were affected. Neither team gave amounts stolen or secured. Web3Auth said it would provide further details when recovery operations were complete.
Why the recovery is taking longer for some assets
Keplr said staked and locked assets make recovery more complex and take longer. Staked assets are assets placed in a system for a set period, and locked assets cannot be moved freely during that period.
Next steps for the recovery effort
Keplr said it is working with Web3Auth on a way for users to check whether their accounts are affected. Web3Auth said it would share more details after the recovery operations are complete.
Original report
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Canaan sells Bitcoin and Ethereum to fund share buybacks after $97.6 million loss
