On November 9, a sudden security alert disrupted the daily life of Cosmos users: according to GoPlus monitoring, a vulnerability in Web3Auth, which Keplr wallet relies on, was exploited by attackers targeting wallet addresses created or logged in through social accounts like Google or Apple. Some users' private keys or transaction signing permissions were suspected to be under remote control. The on-chain results were extremely intuitive—according to the same source, assets equivalent to at least about one million dollars have been stolen from affected addresses, and during the same phase when the attack was exposed, assets equivalent to about six million dollars were urgently transferred to an officially confirmed rescue address, attempting to build a final firewall before further fund outflows. As several Chinese crypto media outlets quickly relayed and amplified this monitoring conclusion, the question was brought to the forefront: when you easily "log in on-chain" with familiar social accounts, do you really control your private keys, or does an invisible third-party intermediary? The structural contradiction between the convenience of social login and the security boundaries of private keys being rewritten by intermediary services was clearly laid on the table during this attack.

Failure of Third-party Login: How Attackers Gained Signing Privileges

Clicking "Continue with Google" in Keplr or logging in with an Apple account seems to just follow your familiar internet habits, but what really happens is that the signing authority is transferred from yourself to an intermediary service provider. Behind social login, third parties like Web3Auth usually provide connection; they are responsible for mapping your Google and Apple identities into a set of cryptographic private keys that can be used on Cosmos and manage your signing sessions with the blockchain. Many users under this path have never truly encountered mnemonic phrases or private key files; they only see "account login successful," yet do not realize that the intermediary holds decisive control over the generation, access, and invocation of private keys in the background.

According to GoPlus monitoring, the vulnerability occurred precisely in this intermediary layer: Web3Auth experienced security issues, leading to a risk of "private key leakage or theft of transaction signing capability" for some users who logged into Keplr through social login. For attackers, there is no need to invade your computer or steal local wallet files directly; if they can successfully exploit the Web3Auth vulnerability, they could initiate on-chain signatures in your name, transferring assets from affected addresses or executing other sensitive operations, and these transactions would appear on-chain as if you had authorized them. Current public materials have not disclosed the specific technical causes or utilization details of this vulnerability, but it is certain that the core issue exposed by this event is not the traditional sense of a local wallet being hacked, but systemic risks caused by the failure of third-party social login services that represent users exercising signing authority.

Six Million Dollar Emergency Transfer: Self-rescue Action on the Rescue Address

During the same phase of the vulnerability being exploited, according to GoPlus reports, approximately six million dollars' worth of assets were concentrated and transferred from a batch of affected Keplr wallet user addresses to an "officially confirmed" rescue address, seen as a rapid emergency action to reduce further losses after the attack was exposed. In timing, this transfer appeared almost simultaneously with the leakage of private keys and the loss of signing authority, and what was presented on-chain was not an ongoing sweep by attackers, but rather a party extracting funds that had not yet been stolen from user addresses to a relatively secure centralized location at a unified pace.

This step has been labeled as "rescue" in narrative, but it also exposes a more difficult reality to avoid: under the social login framework, parties involved in the event seem to have centralized disposal capabilities over some users' assets in extreme situations. Who initiated these transfers, who controls the rescue address, and how signing was completed without user intervention for each transaction are questions that the current public materials do not answer, leaving behind an established fact on-chain—that a large amount of assets have been uniformly migrated to the same address. In the short term, this emergency transfer appears to give some recovery to the failed system, at least building a temporary firewall for the funds that have not been stolen; in the long term, the six million dollars on the rescue address became a touchstone for trust boundaries: in the face of yet-to-be-publicly clarified follow-up disposal and compensation plans, users had to re-assess how much signing authority they truly controlled and how much control is in the hands of the "rescuers" they have never seen.

The Wallet Trust Chain in the Cosmos Ecosystem is Tightened

For the vast majority of Cosmos users, Keplr is not just an independent wallet interface, but more like the default entry point to the entire ecosystem: using it to connect various on-chain applications, using it to sign every cross-chain or staking operation. Many users have never directly interacted with mnemonic phrases, but instead choose to "log in with one click" using Google or Apple accounts in Keplr; on the surface, this seems just a more convenient way to open the door, but in reality, it quietly adds a multi-layered trust chain from public chains to wallets to social accounts—users first trust the Cosmos protocol, then hand over signing authority to Keplr, and finally delegate key generation and management to third-party service providers like Web3Auth to complete the mapping of accounts and cryptographic keys.

This security incident has exposed precisely the least conspicuous link in this chain. According to public materials, this round of risk points clearly points to social login service providers, rather than technical vulnerabilities in the Cosmos protocol itself; but for end users, the attack occurred on the addresses they operated through Keplr, and funds were transferred out from accounts they deemed to belong to "Cosmos wallets," so the perceived loss naturally extends to doubts about the entire ecosystem. When assets were urgently concentrated into the rescue address, Keplr, Web3Auth, and the yet-to-reveal "rescuers" were twisted into a new trust community, and concentrated media reporting further amplified this tension, turning an incident that could have been categorized as a failure of intermediary services into a public discussion about whether the Cosmos wallet system is reliable. For the Cosmos ecosystem, this collective doubt surrounding wallets and intermediary services has become an inescapable trust pressure test.

Convenience or Risk? The Cost List of Social Login Wallets

For most ordinary users, logging in with one click using their Google or Apple account is much easier than remembering 12 or 24 mnemonic phrases or managing a hardware device. With a smartphone in hand and an account logged in, Cosmos assets in Keplr can be signed for transfer at any time; this path almost replicates the habits of Web2, allowing the inherently high-barrier operation of "self-managing private keys" to be packaged as a familiar button. When forgetting passwords, users instinctively believe they can retrieve them through email, phone number, or social accounts, a whole set of "security redundancies" backed by large companies and third-party service providers is seen as a comfortable and natural default option.

However, this incident lays bare the costs on-chain: when the intermediary service responsible for social login has a vulnerability, users do not just lose a login entry; they may directly expose private keys or transaction signing privileges, and according to monitoring statistics, at least about one million dollars' worth of assets have been paid for this. More troublesome is that public information has yet to disclose the number of affected addresses, specific cryptocurrencies, and distribution of stolen assets, many users are even unaware of how large their risk exposure is, and numerous media have simultaneously issued warnings, reinforcing the narrative of "centralized risk points behind convenience." Under this tension, the market must reevaluate the positioning of intermediary layers like Web3Auth: is it truly infrastructure that lowers barriers, or is it concentrating the trust that should be dispersed between users and wallets into a critical single point that once compromised could impact the entire ecosystem?

After the Alarm is Sounded: How Keplr Users and the Industry Respond

This attack and rescue surrounding Keplr's social login directly tore apart the "security illusion" in users' perceptions: according to GoPlus monitoring, assets equivalent to at least about one million dollars were stolen during the vulnerability exploitation phase, while assets equivalent to about six million dollars were urgently transferred to an officially confirmed rescue address. The security alarms and reports densely appearing around November 9 made ordinary users of the Cosmos ecosystem realize for the first time that what they entrusted to the intermediary was not just "login convenience," but rather complete private keys or signing authority. For individuals, a realistic direction for adjustment is to start distinguishing between "convenient wallets" and "fund wallets": social login can remain in small, low-risk daily scenarios, while truly long-term and risk-resistant assets should return to the path of self-managing private keys, allowing oneself to hold mnemonic phrases and signing devices, and then assess whether to accept slicing or custodial models like Web3Auth. For the industry, the current public information has not provided a technical review of the Web3Auth vulnerability, the scale of affected users, or the on-chain distribution of stolen assets; there has also been no complete disposal plan or follow-up user protection arrangements from Keplr or Web3Auth, which will all become key variables that must be continuously tracked in the future, with their direction determining whether social login can still be regarded as an acceptable entry option in the crypto world.

Join our community, let’s discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。