Keplr Wallet Biometric Authentication: Face ID, Fingerprint, and Spoofing Vulnerabilities

A user downloads Keplr Wallet to manage tokens across Cosmos Hub, Osmosis, and several other IBC-enabled blockchains. The setup process offers a choice: protect the wallet with a traditional PIN, or enable biometric authentication using Face ID on iOS or a fingerprint sensor on Android. The biometric option feels more secure—faster, more convenient, and seemingly harder to crack than a simple numeric code. But the security of any authentication layer depends not on how it feels, but on what it actually protects, how it can be defeated, and whether the convenience justifies the trade-offs involved.

Biometric authentication in cryptocurrency wallets exists in a peculiar position. The underlying private keys remain offline and encrypted on the user’s device, which is genuinely strong. Yet the biometric system sits between an attacker and those keys, acting as a barrier that is sometimes weaker than the assets it guards. Understanding what biometric authentication in Keplr actually does—and what it does not do—requires examining the sensor technology, the spoofing methods that work against it, and the scenarios where a PIN might actually offer better security than fingerprint or facial recognition.

Klik Gambar

How Keplr implements biometric locking on mobile platforms

When a user enables biometric authentication in Keplr’s iOS or Android app, the wallet does not store the biometric data itself. Instead, it uses the device’s native biometric framework—Apple’s LocalAuthentication API and Android’s BiometricPrompt—to delegate authentication to the operating system. The wallet encrypts the private keys stored on the device, then stores an encrypted reference or token that can only be decrypted after the OS-level biometric check succeeds. This design is architecturally sound: the wallet does not handle raw biometric templates, and Apple or Google’s implementation bears responsibility for sensor validation.

The practical flow works like this. A user opens Keplr and attempts to approve a transaction or access sensitive settings. The app triggers the OS biometric prompt, which activates the camera for Face ID or the fingerprint sensor for Touch ID or Android fingerprint readers. If the sensor confirms a match against the enrolled template, the OS returns a cryptographic token to the app, which then decrypts the stored key material. If the biometric check fails, the token is never issued and the private keys remain locked.

This layering is important because it means the security of Keplr’s biometric feature depends on three elements: the sensor hardware itself, the OS implementation that interprets sensor data, and the encryption of key material on disk. A weakness in any of these layers can undermine the others. A sensor that is easily spoofed, an OS that fails to validate the token correctly, or plaintext key storage would each defeat the system, even if the other components were robust. The non-custodial nature of the wallet—meaning users control their own keys—makes this architecture a genuine improvement over centralized services that hold keys server-side, but it does not make the authentication mechanism invulnerable.

Users setting up Keplr should understand that enabling biometrics is a trade-off between convenience and a slightly broader attack surface. A PIN-only wallet requires an attacker to either know or guess a numeric code, or to compromise the device so thoroughly that the encrypted key storage is bypassed entirely. Biometric authentication can be faster and more resistant to shoulder surfing or keyboard logging, but it introduces a new attack surface: the sensor and the matching algorithm.

Facial recognition spoofing: Photo attacks and 3D masks

Face ID on iPhone and similar systems use structured light or TrueDepth sensors to create a 3D map of the user’s face, which is significantly harder to spoof than a 2D photograph. Early facial recognition systems could be defeated with a high-resolution printed photo or a smartphone displaying an image. Modern systems are designed to reject these attacks by detecting the lack of depth information. However, the question is not whether Face ID can be spoofed in a laboratory setting under ideal conditions. The question is whether a realistic spoofing attack—one that an opportunistic attacker with brief physical access to a phone could execute—is practical.

Research has shown that sophisticated 3D-printed masks or silicone face replicas can sometimes fool depth-based facial recognition, but these attacks require significant preparation time, often several minutes, and may require custom equipment. More practically concerning is the attack that requires no special equipment: an unlocked or partially-compromised device. If an attacker gains physical access to a phone and the owner is physically nearby, an attacker can simply hold the device to the user’s face to unlock it using the stored biometric. This is not a flaw in the technology; it is a limitation of biometric authentication in general. Unlike a PIN, a biometric cannot be withheld if the user is present.

A second realistic concern is the scenario where an attacker has access to a dead or unconscious user, or to a user under duress. A fingerprint or facial biometric cannot refuse to match. The human body does not have a “forget this biometric” mechanism equivalent to an amnesia-inducing pill. In high-risk situations—a user traveling through a country with hostile authorities, or facing a criminal who knows the user carries cryptocurrency—biometric authentication becomes a liability rather than a security feature.

For routine personal security, iPhone’s Face ID offers a high bar against casual spoofing. The risk profile changes dramatically when physical access and time become available to an attacker. Apple’s guidance itself acknowledges this: Face ID is disabled after a hard restart, after five failed attempts, or after the device has not been unlocked for 48 hours. These mechanisms force a PIN entry and prevent unlimited biometric attempts. They are security controls that exist precisely because the company recognizes that biometrics alone are insufficient.

Fingerprint sensor attacks and latent print vulnerabilities

Fingerprint sensors—whether capacitive, optical, or ultrasonic—capture a reduced resolution image or scan of a user’s fingerprint ridge pattern. This data is then compared against an enrolled template. Unlike Face ID, fingerprint sensors have a longer history of practical spoofing attacks, and the technology has some inherent limitations that are difficult to overcome.

The most straightforward attack involves creating a fake fingerprint using materials such as gelatin, latex, or specially formulated silicone. Researchers have demonstrated that high-quality synthetic fingerprints can fool optical and capacitive sensors in controlled conditions. However, the practical barrier is higher than it might initially appear: creating a working replica requires either stealing a clear fingerprint image (from which the ridge pattern can be reconstructed) and then fabricating a physical replica, or using a molded cast from the person’s actual finger. This is more laborious than spoofing a photograph, but it is not impossible with time and access.

A more concerning vulnerability is the latent print problem. When a user touches a phone screen, keyboard, coffee mug, or any surface, they leave behind invisible oils and sweat residues that form a latent fingerprint. These prints can be photographed with specialized lighting or even lifted and then used to create a replica. An attacker with brief access to a device could photograph the fingerprint sensor surface, then construct a working replica. This attack has been demonstrated in academic research and is within the capability of motivated individuals with basic forensic materials.

Android fingerprint sensors present additional variation because manufacturers implement their own hardware and matching algorithms. Some Android devices have been demonstrated to accept fingerprints from fingers other than the enrolled finger, or to be spoofed by relatively simple materials. The quality and spoofing resistance vary significantly between devices and sensor manufacturers. A user with a high-end phone from a major manufacturer and a recent Android version has better protection than a user on a budget device with older firmware.

The physical access threat model and enforcement scenarios

The realistic question is not whether biometric authentication can be spoofed under any circumstances. It is whether the authentication mechanism meaningfully raises the cost of attack for the threat model that actually matters to the user. A Keplr Wallet user in a routine personal security scenario faces different risks than a user in a high-stakes environment.

For the routine user, the threat model includes lost or stolen phone, malware, accidental misclicks on malicious websites, and opportunistic criminals. Biometric authentication defends against some of these. A thief with a stolen phone cannot simply guess a PIN; they would need to spoof the biometric or use a hardware attack to extract the keys. Malware running in the background cannot silently approve transactions without triggering the biometric prompt, making it at least partially visible to the user (assuming the user pays attention to what they are approving). A PIN does not provide these protections; it is static and can be captured by a keylogger or observed through shoulder surfing.

For the high-risk user—someone in a jurisdiction with an authoritarian government, an activist at risk of physical targeting, or a person holding a significant amount of assets—the threat model is different. In these scenarios, physical access under duress or coercion becomes realistic. A fingerprint or face can be used without consent. Authorities or criminals can detain a user and demand they unlock the device. A memorized PIN, especially a strong one, is more defensible: a user can plausibly claim to have forgotten it, or to refuse to provide it, in ways that a biometric cannot support. Some hardware wallets and advanced security practices address this through duress codes or hidden wallets, but standard mobile biometric authentication offers no equivalent protection.

The third scenario involves temporality. If a user is traveling and their phone is stolen or accessed by a border agent, the window of vulnerability depends on the authentication method. With a PIN, the attacker must guess correctly or brute force attempts within limits. With biometric authentication, the attacker has a single attempt that matches perfectly, and that attempt leaves no trace in the system log. The attacker does not need to guess; the biometric is intrinsic and irreproducible.

Spoofing detection and anti-liveness checks in practice

Modern mobile operating systems and some third-party apps implement anti-spoofing measures, collectively called “liveness detection.” These checks attempt to distinguish a living person from a photograph, video, or replica. Apple’s Face ID uses depth information—the TrueDepth sensor creates a 3D model—which makes it genuinely difficult to spoof with a flat image. Android’s BiometricPrompt can require liveness checks, though the implementation varies by manufacturer and device.

Liveness detection is not foolproof. Research has shown that presentation attacks—where an attacker presents a fake fingerprint or face to the sensor—can sometimes defeat liveness checks, especially on less sophisticated implementations. The arms race between spoofing and anti-spoofing is ongoing. An attacker publishes a technique, vendors patch it, researchers find a new angle, and the cycle continues. The question for a Keplr user is not whether their device’s liveness detection is perfect, but whether it is good enough to raise the cost above what an attacker is willing to invest.

For casual threats, modern Apple and high-end Android devices likely provide sufficient protection. A thief or curious acquaintance is unlikely to invest the time and materials required to create a convincing replica or to research device-specific spoofing techniques. For sophisticated attackers—forensic examiners, intelligence agencies, criminal organizations—these protections are less reliable. The same applies to behavioral authentication: if a device requires the user to perform an action (blink, tilt head, show movement), determined attackers can sometimes circumvent these checks with videos or automated replay attacks.

The practical implication is that biometric authentication in Keplr should be treated as a convenience and a protection against casual threats, not as an absolute barrier. It is stronger than a PIN against opportunistic access, but weaker than a PIN against determined coercion or in high-risk scenarios. The keplr wallet setup process should ideally make this trade-off explicit rather than implying that biometrics are universally superior.

Hardware wallet integration and the broader security stack

Keplr’s support for Ledger hardware wallet integration changes the threat model substantially. A Ledger device stores private keys offline and never exposes them to the internet or to the mobile phone. When a user approves a transaction via Ledger, the phone sends an unsigned transaction to the hardware wallet, which displays it on its own screen for verification, then signs and returns the signed transaction. The phone never holds the key material.

In this configuration, biometric authentication on the phone becomes less critical because the keys are not at risk even if the phone is compromised. An attacker who gains access to the phone without the hardware wallet cannot move assets. The biometric layer only controls access to the phone interface and the dApp connections, not to the keys themselves. This is architecturally cleaner: each component is responsible for its own security, and the phone’s compromise does not cascade into key theft.

For users not using a hardware wallet, the device-based encryption and biometric authentication are the primary defense. In this case, the biometric serves a real purpose: it prevents casual unlocking and enforces a procedural checkpoint each time a sensitive operation occurs. However, the user must also trust that the device’s encryption is implemented correctly, that the OS is free of vulnerabilities, and that the private keys were never exposed during wallet setup or recovery.

The practical recommendation for a user with significant assets is to use a hardware wallet if possible, reducing reliance on device biometrics. For a user managing moderate amounts on a mobile-only setup, enabling biometric authentication provides a meaningful improvement over PIN-only access by raising the cost of unauthorized use. The choice should be informed by honest assessment of the threat model rather than by marketing claims about “military-grade” security.

Comparing PIN, biometric, and multi-factor authentication models

A PIN is static, can be observed or captured, but cannot be reproduced from the user’s body. A biometric is dynamic, cannot be observed, but can be replicated or compelled. Neither is objectively superior; they protect against different attacks. A strong PIN—one that is not a birthday, sequential numbers, or other common pattern—requires an attacker to either brute force within rate limits or to observe the user entering it. A fingerprint requires creating a physical replica or stealing a latent print image.

Some security-conscious users implement multi-factor authentication: a PIN combined with biometric, such that both must succeed in sequence. This requires an attacker to either know the PIN and spoof the biometric, or to compromise the device so thoroughly that both checks are bypassed. However, each additional factor also increases the friction for legitimate use, and a user frustrated by repeated authentication prompts may weaken security by disabling biometrics or using weaker PINs.

The optimal configuration depends on the user’s actual threat model and usage pattern. A casual investor managing a portfolio of tokens on Cosmos-ecosystem chains and checking it once a week may benefit from the convenience of Face ID, accepting the spoofing risk as acceptable. A user making frequent transactions, handling substantial assets, or operating in a high-risk environment should consider a PIN combined with hardware wallet isolation, or at minimum, a strong PIN without biometric backup that could be compelled.

Users should also be aware that some keplr security implementations default to biometric without requiring explicit acceptance of the trade-offs involved. The setup wizard may present biometric as the “recommended” option without explaining that a PIN in high-risk scenarios can be superior. A better interface would allow users to understand the specific threats they are trying to defend against, then recommend the appropriate authentication method accordingly.

Recovery scenarios and the problem of persistent biometric data

When a user sets up Keplr, they create or import a wallet and are given a recovery phrase (also called a seed or mnemonic). This recovery phrase is the master key to the wallet. If the phone is lost, wiped, or replaced, the user can restore the wallet on another device using the recovery phrase. The biometric setting is not transferred; the user would need to re-enroll their fingerprint or face on the new device.

The security implications cut both ways. If a user’s phone is lost, an attacker cannot use the biometric to unlock the wallet on that lost device because biometric enrollment is device-specific. However, the attacker could restore the wallet on a different phone using the recovery phrase, if they obtain it. This is why the recovery phrase must be protected more carefully than the biometric. The recovery phrase is the ultimate key; the biometric is merely a convenience lock on that key.

A less obvious concern is the persistence of biometric data on a device. If a phone is sold, given away, or stolen, the biometric enrollment data may persist in the device’s secure enclave or trusted execution environment. On some Android devices, this data has been extracted by determined attackers. The device’s biometric data—a template of the user’s face or fingerprint—could potentially be stolen and used to forge authentication even on a different device, depending on how portable the biometric is across systems. In practice, biometric templates from one device are usually not directly transferable to another, but the risk of theft is real.

Users should therefore treat device deprovisioning seriously. When selling or disposing of a phone, the device should be reset to factory settings and, ideally, encrypted before reset. The recovery phrase should be removed from the phone before it leaves the user’s hands. The biometric enrollment should be erased as part of the factory reset. Keplr does not store the biometric data—the OS does—but the wallet’s sensitivity means that the underlying device security is critical.

Practical recommendations for secure biometric use in Keplr

Based on the analysis of vulnerabilities and threat models, a user should consider the following when deciding whether to enable biometric authentication in Keplr. First, assess whether the threat model involves physical access and coercion. If it does, a strong PIN is more defensible than a biometric that can be used without consent. Second, evaluate the device’s biometric hardware. An iPhone with Face ID offers better protection than a budget Android phone with an optical fingerprint sensor. Third, consider whether other security measures are in place—specifically, whether a hardware wallet is being used to keep keys offline.

If biometric authentication is enabled, the user should still maintain a strong PIN as a backup. The PIN should not be stored on the phone, in a cloud service, or anywhere that could be accessed if the device is compromised. It should be memorized or written on paper and stored physically separated from the phone. In the event of a biometric sensor failure or if the user ever needs to disable biometric authentication, the PIN becomes the lifeline.

Users should also verify the recovery phrase is stored securely and separately from the phone. The recovery phrase is not protected by biometric authentication; anyone with the phrase can restore the wallet on any device. This makes the phrase more valuable to an attacker than the phone itself. The phrase should be written on paper or engraved on steel, stored in a safe, and never photographed or typed into a digital device. The keplr wallet setup process ideally guides users through secure storage of the recovery phrase as part of initial setup, rather than treating it as an afterthought.

Finally, users should keep their device and operating system up to date. Apple and Android regularly release security patches, some of which address biometric or authentication-related vulnerabilities. Delaying updates increases the window of exposure to known exploits. Biometric spoofing techniques also evolve; an older device may be vulnerable to attacks that newer devices are designed to resist.