Web3Auth Issues Official Statement on Keplr Incident, Clarifying Transfer Nature
In response to recent security concerns within the Keplr wallet community, Web3Auth released an official statement on November 8th. The primary aim was to clarify the true nature of certain on-chain transactions that had been widely misinterpreted by the community as "attacker activity." These were, in fact, protective asset transfers initiated proactively by the project team.
Official Recovery Address Released, Funds Under Secure Custody
Web3Auth stated that, with support and coordination from the Keplr team, affected user assets have been moved to a dedicated recovery wallet. To ensure transparency, the project published the verified recovery address. The announcement stressed that this address is solely controlled by Web3Auth and is used exclusively for safeguarding the impacted funds; it is not under any malicious actor's control. This action is designed to mitigate potential risks and facilitate the future process of asset return.
Incident Context and User Security Recommendations
The confusion arose when these protective operations appeared as unusual large-volume transfers on blockchain explorers, triggering alert and misunderstanding among users. Web3Auth provided a detailed explanation to dispel unwarranted concern.
Furthermore, the statement reiterated the prior security advice from Keplr: users who currently access their wallets via social logins (such as Google or Apple) should, for long-term security, promptly transfer any remaining liquid assets to a self-custody account created and controlled via a traditional seed phrase or hardware wallet. Such accounts, where users hold their private keys, offer significantly higher security than solutions reliant on third-party logins.
- Key Clarification: Misinterpreted transfers were official protective actions, not an attack.
- Transparent Action: Recovery address published, funds are secure.
- Long-term Advice: Users urged to migrate from social logins to self-custody wallets.