Web3Auth Flaw and LNbits Shutdown Warning Expose Crypto Wallet Weak Points
Attackers exploited a Web3Auth vulnerability to steal crypto from Keplr wallets using Google and Apple logins, while LNbits has urged all operators to shut down amid active Lightning wallet attacks. Web3Auth shifted over $6 million into recovery wallets, and one LNbits operator reported a loss of 2.28 million satoshis.
Two separate security problems are hitting cryptocurrency infrastructure at once, highlighting how fragile some wallet layers remain.
In the first case, hackers exploited a flaw in Web3Auth to drain funds from Keplr wallets that were accessed through Google and Apple logins. Web3Auth provides an authentication system that lets users manage crypto without handling private keys directly. The vulnerability allowed attackers to compromise that login layer and reach underlying wallets.
In response, Web3Auth took the unusual step of moving user funds itself. The company transferred more than $6 million into recovery wallets, emptying thousands of accounts it deemed at risk before attackers could reach them. That move may have limited further theft but also underscored how much control an intermediary service can have over assets that users may see as self-custodied.
At the same time, LNbits, a platform for running Bitcoin Lightning wallets, has issued an urgent warning for all server operators to shut down immediately. The alert came amid a wave of attacks exploiting an extension in the LNbits software.
One operator reported that the attackers used the vulnerable extension to steal 2.28 million satoshis. While that amount is smaller than the losses tied to the Web3Auth incident, it shows that the same pattern—targeting the software layer between users and the blockchain—is affecting Lightning infrastructure as well.
Both episodes point to a common risk: services that sit between people and their coins, whether as login providers or wallet hosts, can become single points of failure. The key questions now are how quickly fixes are deployed, whether the stolen funds can be traced or recovered, and what new security requirements exchanges, projects, and regulators may impose on these types of providers.
Sources
- OSINT