Keplr ເຕືອນຜູ້ໃຊ້ເຂົ້າລະບົບ Google/Apple ຫລັງ Web3Auth ເປີດເຜີຍກະແຈ
ບັນຊີ X ທາງການ Keplr ລະບຸວັນທີ 7 ພະຈິກ 2026 (17:17 UTC / 00:17 ເວລາວຽງຈັນ ວັນທີ 8 ພະຈິກ) ວ່າ ຂໍ້ບົກພ່ອງໂຄງສ້າງ Web3Auth ເຮັດໃຫ້ກະແຈສ່ວນຕົວຂອງບາງຜູ້ໃຊ້ທີ່ເຂົ້າລະບົບດ້ວຍ Google ຫລື Apple ຖືກເປີດເຜີຍ. ບັນຊີທີ່ສ້າງດ້ວຍ Recovery-phrase ຫລື ກະເປົາຮາດແວ ບໍ່ຖືກກະທົບ. Keplr ກຳລັງຊ່ວຍ Web3Auth ປົກປ້ອງຊັບສິນ; ບາງບັນຊີ Google/Apple ອາດສະແດງຍອດຫລຸດ ຫລື ວ່າງແລ້ວເພາະມາດຕະການກູ້ເຫລົ່ານັ້ນ.
ຄຳແນະນຳປັດຈຸບັນຂອງ Keplr: ຢ່າສົ່ງເງິນໃໝ່ເຂົ້າບັນຊີ Google/Apple ທີ່ອາດຖືກກະທົບ; ຍ້າຍຊັບສິນທີ່ເຄື່ອນໄຫວໄດ້ໄປກະເປົາ Recovery-phrase ຫລື ຮາດແວ; ເຊື່ອຖືສະເພາະບັນຊີທາງການ @keplrwallet ຫລື @Web3Auth; ບໍ່ຕອບ DM ຫລື ລິ້ງທີ່ອ້າງ “ກູ້ກະເປົາ.”
Web3Auth ລະບຸວ່າ ໄດ້ເລີ່ມໂອນກູ້ແບບ whitehat ເຂົ້າກະເປົາກູ້ທີ່ປອດໄພ, ໃຊ້ເສັ້ນທາງດຽວກັບ “ຜູ້ໂຈມຕີຕົ້ນສະບັບ,” ແລະ ຕໍ່ມາຢືນຢັນວ່າກຳລັງໂອນຊັບສິນເຂົ້າກະເປົາກູ້ດ້ວຍການຊ່ວຍຂອງ Keplr. The Block ລາຍງານປະມານ $5.6 ລ້ານໃນກະເປົາກູ້ທີ່ Web3Auth ເຜີຍ, ຕາມການກວດເທິງເຄືອຂ່າຍຂອງ The Block ວັນທີ 8 ພະຈິກ — ຕົວເລກນີ້ເປັນການປະເມີນກະເປົາກູ້ຂອງ The Block, ບໍ່ແມ່ນຍອດສູນເສຍທີ່ Web3Auth ລະບຸເທິງ X. Web3Auth ຍັງບໍ່ເຜີຍຍອດຄວາມເສຍຫາຍຢ່າງເປັນທາງການ. ການປະເມີນກະແສຂອງ Bitquery ທັບຊ້ອນກັບທີ່ຢູ່ໃນລາຍການກູ້ຕາມ The Block, ບົດຄວາມນີ້ບໍ່ໄດ້ບອກວ່າເປັນການແຮັກຢ່າງດຽວ ແລະ ບໍ່ມີການເປີດເຜີຍທີ່ຢູ່ກະເປົາ.
ພະນັກງານ bitqik ຈະບໍ່ຂໍລະຫັດຜ່ານ, ລະຫັດ 2FA ຫລື seed phrase ຂອງທ່ານ.
ເງິນຄຣິບໂຕ ບໍ່ແມ່ນເງິນ ແລະ ບໍ່ແມ່ນເຄື່ອງມືຊຳລະທີ່ຖືກຕ້ອງຕາມກົດໝາຍ ຂອງ ສປປ ລາວ (ແຈ້ງການ ທະນາຄານແຫ່ງ ສປປ ລາວ ເລກທີ 156/ຫກ, ລົງວັນທີ 11 ສິງຫາ 2021).
Keplr Warns Google and Apple Login Users After Web3Auth Key Exposure
Keplr’s official X account said on 7 November 2026 (17:17 UTC / 00:17 Vientiane on 8 November) that a Web3Auth infrastructure vulnerability led to a private-key breach for some users who signed in with Google or Apple. Recovery-phrase and hardware-wallet accounts are not affected. Keplr is assisting Web3Auth’s effort to secure assets; some Google/Apple-login accounts may already show a reduced or empty balance because of those mitigation efforts.
Keplr’s current guidance: do not send new funds to an affected Google/Apple-login account; move any remaining liquid assets to a recovery-phrase or hardware-wallet account; trust only @keplrwallet or @Web3Auth; ignore DMs or links offering “recovery.”
Web3Auth said it began whitehat recovery transfers into secure recovery wallets, using the same path as an “original attacker,” and later posted that it had been transferring assets into secure recovery wallets with Keplr’s assistance. The Block reported about $5.6 million held in Web3Auth’s published recovery wallets as of its 8 November article, based on The Block’s own on-chain review — that figure is The Block’s recovery-wallet estimate, not a Web3Auth-stated loss total on X. Web3Auth has not published a verified loss amount. Bitquery’s larger flow estimates overlap addresses The Block says are on Web3Auth’s recovery list, so those flows must not be described as theft alone. This draft does not publish recovery addresses.
bitqik staff will never ask for your password, 2FA code or seed phrase.
Cryptocurrency is not money and is not a lawful means of payment in the Lao PDR (Bank of the Lao PDR Notice No. 156/ຫກ, 11 August 2021).
Source: Keplr official X (7 Nov 2026, 17:17 UTC) – https://x.com/keplrwallet/status/2119117067500806350
Additional sources:
- Web3Auth official X recovery update (8 Nov 2026, 06:23 UTC) – https://x.com/Web3Auth/status/2119314957057871935
- Web3Auth official X (whitehat recovery context, 7 Nov 2026) – https://x.com/Web3Auth/status/2119114301654929896
- The Block (8 Nov 2026; about $5.6M on-chain review of recovery wallets; Bitquery overlap note) – https://www.theblock.co/news/defi/2026-11-08-web3auth-says-it-frontran-hackers-by-moving-5-6-million-out-of-exposed-keplr-wallets-436029
- Bank of the Lao PDR Notice No. 156/ຫກ (disclaimer basis) – https://www.bol.gov.la/fileupload/13-08-2021_1628839332.pdf
