The truly time-tested methods of preservation are often simple, intuitive, and easy to understand, with the fewest steps and minimal trust requirements.

Written by: Liu Jiaolian

Keplr's social login wallet encountered issues, resulting in assets being transferred from thousands of accounts, with the official response pointing to a vulnerability in the Web3Auth infrastructure. Most users who were robbed did not make any mistakes; they simply opted for convenience by using Google or Apple to log in and create this wallet.

The specific cause of the incident has not yet been disclosed in detail. The vendors are also shifting blame among each other. Following this clue, Jiaolian conducted a brief study and compared the security strategies used by several typical wallets to see what issues exist.

First, we take traditional cryptocurrency self-custodial strategies as a reference benchmark, meaning users write down their mnemonic phrases on paper and securely store them.

This strategy is very simple; the keys are in your hand, and no one knows. Its security boundary is you: don’t lose the paper, don’t take a photo, don’t tell anyone. The downside is that human memory is unreliable — fire, moving, doing laundry, any of these could cause that paper to disappear. But the benefit is that the risk segment is right there on that paper; you can see it at a glance and you are very clear about it. Being very clear means you know you should take 120% of precautions to guard against it.

With this reference benchmark, let's next look at several currently popular wallet apps in the industry regarding their private key custody strategies. Note that we are excluding centralized exchange solutions that directly manage all control rights, and we are discussing solutions that manage mnemonic phrases for private keys without managing the complete asset control rights.

First, let's look at the approach of the Uniswap wallet: its strategy is relatively simple, which is to encrypt the mnemonic phrase and back it up to your own iCloud or Google Drive.

A string of ciphertext is stored on Apple's server, and the decryption password is in your mind. When recovering, you need to log in to your cloud account and then enter the password that was specifically used to encrypt the mnemonic phrase; it is not the same as your Apple ID. The cloud service provider only has the ciphertext, which theoretically cannot be decrypted. The risk has shifted to the account side: if your Apple ID is stolen, the verification code is intercepted, or a phishing site tricks you into giving your password, any of these could allow a backup to fall into someone else's hands. But at least, the risk is still in a familiar place; the cloud account and password are things you use every day.

The only risk in the cloud is that Apple's or Google's storage service gets hacked. This is also why it chose Apple and Google instead of other cloud service providers since it relatively trusts the security strength of these two giants more.

Next is the most classic web3 wallet, MetaMask (commonly known as the fox wallet), which uses social login. Its method is much more complicated: the encrypted mnemonic phrase exists on MetaMask's own servers, and the decryption keys are split into several pieces, distributed to different server nodes; to recover, you need two things: a login credential from Google, Apple, or Telegram, and the password you set [3]. Only when both are gathered can the key be reassembled.

MetaMask specifically states that even if the servers are completely taken down, what an attacker gets are just fragments, and they still need to crack your password. This is true, but it depends on what premises are given. Normally, online recovery requires the login credential as the first barrier, the server-side rate limit as the second, and the password as the third; a weak password will not be immediately cracked. However, once the shard nodes are compromised and an attacker obtains the fragments, they can perform offline brute force attacks on their own machine, letting the rate limits become ineffective; at this point, the strength of the password becomes the only line of defense.

Lastly, let's take a look at the solution used by Keplr that encountered issues this time. The key is split into three pieces: one on the user's device, one on a cloud server, and one as a recovery backup, reassembled by the server after login [4]. The design allows any two pieces to be sufficient to restore the private key. However, as long as two pieces are actually controlled by the same service provider, the threshold of three pieces degrades to a single point of attack. This incident, Jiaolian instinctively feels, likely occurred in this area; however, the real situation will need to wait for the vendors to disclose more concrete technical details.

When comparing the above four methods, a counterintuitive pattern emerges.

From the first to the fourth, it seems that the locks are increasing, the components are growing, the systems are becoming more complex, all claiming or promising that complex encryption strategies can enhance security. However, the risks that users can see are actually decreasing. The keys written on paper are known to be right there; the ciphertext stored in iCloud is known to be with Apple; in the case of MetaMask, the ciphertext is on the server, fragments are on nodes, and the password is in your mind; understanding four roles is needed before anything can be clarified; and regarding Keplr, when issues arise, users don’t even know whom to hold accountable.

On the other hand, as the complexity of the system increases, the attack surface exposed to hackers is also expanding. How can hackers not feel pleased? Paper and pen have only one risk: being stolen or burned; iCloud backups add one more cloud account; MetaMask’s system increases the login service provider, shard nodes, and password strength; and Keplr adds an entire infrastructure. With each added layer, trust dependencies are dispersed across more levels and links, rather than eliminated.

This diffusion of trust dependence could be fatal. A simple arithmetic: one person managing the key means if they make a mistake, the system fails; if two people handle it, if either one makes a mistake, the system fails. Clearly, the possibility of either of the two people making a mistake is greater than the possibility of one person making a mistake. In linked segments, reliability only declines, it doesn’t improve.

So why design it this way? Because in the first method, the chance of one person making a mistake is far too high. Miswriting a word, losing the paper, getting tossed by a family member as waste paper; these things happen every day. Social login significantly reduces the user error rate, at the cost of introducing risk from service providers. On paper, it might seem advantageous, but the issue is that these two probabilities are invisible to the user, and cannot be verified.

The most ironic point is right here. A solution requires ten pages of documentation to explain why it is secure, and ordinary users have already lost their judgment ability. They can only choose to believe, and belief does not equate to safety; it is a gamble.

Jiaolian couldn’t help but recall that sentence written by Satoshi Nakamoto in the Bitcoin white paper: “When there is a possibility of reversal, the demand for trust becomes pervasive.” Although Satoshi was speaking about online payment scenarios, when it comes to private key recovery, this is inherently a reversible process and will inevitably lead to the diffusion of trust demands.

This diffusion itself implies the expansion of the hacker's attack surface. Every segment that requires trust is a potential entry point for hackers.

The preservation methods that truly stand the test of time are usually simple, intuitive, easy to understand, with the fewest steps and minimal trust requirements. Simple does not mean rudimentary; it means keeping complexity in implementation while leaving determinability to the user.

If a wallet cannot clearly state who holds the keys, then its so-called self-custody and so-called security are just a marketing slogan. If you want to truly own something, the premise is that you can point to it and say, this is mine, I am 100% sure it is right there.