Dogecoin community member Mishaboar has raised concerns about the security risks associated with social signing, a feature that allows users to create and access a blockchain wallet using everyday accounts like Google, Apple ID, Telegram, or email instead of managing a complex seed phrase.
This comes after Keplr, a multichain wallet supporting Cosmos, Bitcoin, Ethereum, and Starknet, stated it had received reports of unauthorized transactions on some Keplr accounts created with Google or Apple login.
The wallet provider stated that the incident has been escalated to the Web3Auth team, with both working together to investigate the matter.
Before Keplr’s disclosure, Web3 wallet infrastructure provider Web3Auth said it was aware of a security issue affecting Web3Auth’s services used by some third parties. It stated that it had temporarily paused the embedded wallet service in response to the issue; however, after an initial investigation, no evidence was found that MetaMask users were impacted.
Social signing risks flagged
In his X post, Mishaboar criticized social signing. “Social signing, the feature you may want to add to your wallet if you hate your users,” Mishaboar wrote.
The concern is particularly significant for inexperienced crypto users who may not recognize the risks associated with connecting their personal accounts to wallet services. While the feature makes wallet creation and access easier, it could introduce security vulnerabilities that users may not fully understand, Mishaboar argued.
“The worst part is that the users that use the social signing option—and who will end up being hacked through it—are also often newbies, entering crypto for the first time. And the risk goes beyond the funds in your wallet—data leaks could link your real-life identity to your holdings, which can have terrible consequences,” Mishaboar stated.
Mishaboar noted that this warning also extends to wallets using social sign-in, which allows users to back up their keys in the “Cloud,” which just means somebody else’s server, he explained.
This week, a security advisory was issued for iOS users, who are urged to update their devices to enhance their wallet security. This follows security researchers identifying two exploit kits, Coruna and DarkSword, which target devices running older iOS versions. These do not rely on a flaw in any wallet app, but once a device is compromised, they can access wallet data stored on it.
