Web3Auth Breach: What Happened to Keplr’s Google and Apple Login Wallets

A Web3Auth infrastructure vulnerability exposed private keys for some Keplr wallets created through Google or Apple social login. Peter explains why this was not a compromise of Google or Apple accounts, how affected wallets could be swept, and what the reported recovery activity means for users.The episode breaks down how Web3Auth reconstructs wallet keys, the difference between a two-of-three Shamir’s Secret Sharing setup and single-factor authentication, and why changing a Google password cannot secure a private key that has already leaked. It also covers the concentration risk of using one social account across many services and the role of unique credentials and password managers.Cardano users also get practical context on social-login wallets, self-custody and the questions to ask before trusting any provider-assisted wallet setup.Chapters:0:00 Intro0:40 What Happened at Keplr2:40 How a Web3Auth Login Works3:56 Shamir's Secret Sharing4:59 Single Factor Mode6:07 Web3Auth's Statement6:22 The Rescue and the Numbers8:32 Should You Sign In With Google?10:07 CZ on Self-Custody10:41 Are Cardano Users Affected?11:12 Wrap UpWhat you'll learn:- Web3Auth said a vulnerability in its own infrastructure led to private keys leaking from some Keplr wallets created with Google or Apple login.- Google and Apple accounts were not identified as the compromised systems; the failure involved the wallet key service behind the social login.- Web3Auth’s typical two-of-three model separates login, device and recovery shares, but single-factor mode can make the network-held share sufficient to rebuild a wallet key.- Changing a Google password cannot protect a wallet after its private key has already leaked.- The episode cites roughly 44,700 swept wallets and about US$5.6 million held in Web3Auth recovery addresses, while distinguishing recovery activity from confirmed theft.- Using one Google account across many services creates concentration risk even when Google itself was not breached in this incident.- Crypto users should understand who can reconstruct their wallet key and whether independent device or recovery factors are required.- Cardano users should review any wallet that uses social login and compare its key-sharing design with seed phrase or hardware-wallet self-custody.Links & References:Full show notes:- https://link.learncardano.io/MBzf2y- https://link.learncardano.io/qiQ3pp- https://link.learncardano.io/wehj3I- https://link.learncardano.io/zsZ82Y- https://link.learncardano.io/EFvn8V- https://link.learncardano.io/bA98t8Website: https://link.learncardano.io/bQ68RcX/Twitter: https://link.learncardano.io/3a1QtvDisclaimer: This content is for educational purposes only. Nothing constitutes financial advice.DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisi