【🚨Security Alert】Keplr Social Login Key Leak & Web3Auth Incident An infrastructure vulnerability at Web3Auth led to private key exposure for certain Keplr embedded wallets created via Google/Apple social logins. On Nov 7, Keplr suspended social login functionality. 💸 Impact: ~44k Cosmos and 7.6k Injective addresses affected.~$6.01M in on-chain asset migration observed. ~1.96M staked ATOM were converted via the Liquid Staking Module (LSM) to bypass the 21-day unbonding period. 🧲 Status: On Nov 8, Web3Auth confirmed that part of the migrated funds belong to white-hat recovery wallets; exact theft amount is still pending. ⛵️ Root Cause: Issue originated in Web3Auth's third-party key management infrastructure, not Keplr smart contracts. Exact exploit vector remains under investigation. 🧰 Action Required: If you use social logins on Keplr, check your account, avoid further deposits, and migrate remaining assets to a new mnemonic or hardware wallet. Seed-phrase and hardware wallets are not affected. Watch out for phishing recovery links. BitsLab Security Takeaway: Wallet security extends beyond smart-contract audits. Third-party auth, key management, and signing infrastructure are critical attack surfaces. BitsLab recommends auditing the entire wallet security stack.