Dogecoin developer warns of risks in Keplr wallet’s social signing feature

Dogecoin community member Mishaboar has voiced concerns regarding the security of social signing features in blockchain wallets. This follows reports of unauthorized transactions affecting some users of Keplr, a multichain wallet that supports Cosmos, Bitcoin, Ethereum, and Starknet. The incidents reportedly involved accounts created using Google or Apple login options.

Security risks tied to social sign-in

Keplr acknowledged receiving these reports and confirmed that it has escalated the issue to the Web3Auth team. Both parties are currently collaborating to identify the source of the unauthorized access and assess the scope of the problem. Keplr’s integration with Web3Auth allows users to bypass traditional seed phrase management by using existing credentials from widely-used platforms, a method known as social signing.

Mishaboar has criticized this convenience, suggesting it leaves users more exposed to security threats. He argued that the ease of using familiar accounts to generate and access blockchain wallets may obscure significant risks for less experienced cryptocurrency participants and could result in compromised funds or personal data.

Social signing, the feature you may want to add to your wallet if you hate your users, Mishaboar wrote, underscoring that the users opting for this method are often newcomers who may not recognize its dangers.

According to Mishaboar, one major concern goes beyond financial losses. Users who rely on social sign-ins risk linking their real-world identity to their crypto holdings, potentially exposing themselves to additional privacy breaches if third-party servers are compromised. He warned that cloud-based key storage, commonly marketed as a safety feature, may in fact place sensitive information on infrastructure controlled by others rather than the user.

Additional vulnerabilities from device security

The latest security advisory urges iOS users to update their devices promptly. Researchers discovered that two exploit kits, Coruna and DarkSword, actively target older iOS versions. These exploits do not stem from wallet-specific vulnerabilities but rather from weaknesses in the device operating system; if a device is compromised, attackers can access wallet data stored locally, regardless of which wallet application is being used.

Experts advise users to implement security updates as soon as they become available, as attackers continue to target mobile devices for storing digital assets. Many in the crypto industry recommend additional protective measures, such as enabling two-factor authentication and minimizing the exposure of personal accounts when creating new wallets.

The risk goes beyond the funds in your wallet—data leaks could link your real-life identity to your holdings, which can have terrible consequences, Mishaboar cautioned.

As new wallet features designed for ease of use become more common throughout the digital asset ecosystem, community members and developers continue to debate how best to balance accessibility with robust security, especially for those new to the cryptocurrency space.