Community members Dogecoin and Mishaboar have raised concerns about the security risks associated with social signatures ( social signing ). Social signatures are a feature that allows users to create and access blockchain wallets using everyday accounts such as Google, Apple ID, Telegram, or email addresses, without the need to manage complex mnemonics.

This statement appears after Keplr. Keplr is a multi-chain wallet that supports Cosmos, Bitcoin, Ethereum, and Starknet. The company stated that it has received reports of unauthorized transactions from some Keplr accounts created by logging in through Google or Apple.

The wallet provider stated that the relevant incident has been escalated to the Web3Auth team, and both parties are jointly investigating the matter.

Before the disclosure of Keplr, Web3, a wallet infrastructure provider, Web3Auth, stated that it was aware of security issues affecting the Web3Auth services used by some of its third-party partners. The company mentioned that it had temporarily suspended its embedded wallet services due to this issue; however, after preliminary investigations, no evidence was found that any MetaMask users were affected.

Social media signature risks are being highlighted

Mishaboar posted on X criticizing social signatures. He wrote, "Social signatures, a feature that if you hate your users, you'd want to add to your wallet."

He believes that this issue is particularly serious for inexperienced cryptocurrency users, as they may not be aware of the risks associated with connecting their personal accounts to wallet services. Although this feature makes it easier to create and access wallets, Mishaboar believes that it can also introduce security vulnerabilities that users may not fully understand.

"The worst part is that users who opt for social signature options and consequently get blacklisted are often novices, entering the crypto world for the first time. The risks are not limited to the funds in your wallet—data breaches can also link your real identity to your holdings, which can lead to terrible consequences," stated Mishaboar.

Mishaboar also pointed out that this warning also applies to wallets that use social login. Such wallets allow users to back up their keys to the “cloud,” but he explained that this is actually just someone else’s server.

This week, a iOS user received a security alert recommending an update to enhance the security of their wallet. This alert came after security researchers identified two toolkits, Coruna and DarkSword, which target devices running older versions of iOS. These toolkits do not rely on any vulnerabilities in wallet applications, but once a device is compromised, they could potentially allow access to the wallet data stored on that device.