Socket Protocol Recovers Two-Thirds of Stolen Funds: Exploit Impacts Bridge Operations
Summary:
Socket, a cross-chain bridge protocol, has managed to recover two-thirds ($2.3 million) of the $3.3 million stolen funds. An exploit targeted 219 users, who lost up to their limit on Socket's over-approval vulnerability. The bug was identified and removed efficiently, making the bridge operational again within 24 hours. However, cross-chain bridges remain a prime target for malicious attacks.
Socket, a cross-chain bridge protocol, has announced that it has successfully reclaimed two-thirds of the funds that were taken from the protocol. The official X account for Socket stated that out of the $3.3 million that was stolen, they have managed to retrieve $2.3 million, equivalent to 1032 ETH. The plan for reimbursement and allocation for the protocol’s users will be unveiled shortly.
The protocol also extended appreciation to several on-chain analytics accounts that assisted in their fund recovery endeavour. On 16th January, an unknown perpetrator exploited a token approval from an Ethereum address that ends with 97a5, impacting wallets that had unlimited approvals to Socket contracts.
The exploit had affected 219 users, leading to a net loss of nearly $3.3 million. The cross-chain interoperability protocol promptly identified the bug that led to the exploit and eliminated it within a matter of hours, allowing the bridge to be back in operation within a day.
The assailant took advantage of the Socket platform’s over-approval vulnerability, draining assets up to the authorized limit for each user. Users would have needed to cancel their authorization before the limits were used up to prevent the loss of these unused limits.
The exploit appears to have resulted from deficient validation of user input, according to PeckShiled, a data analytics firm, which made users who approved the vulnerable SocketGateway contract victims to the exploit. The firm also revealed that the harmful gateway was added three days before the exploit occurred.
In addition to the initial draining of funds, phishers took this opportunity to scam users by posing as Socket under an official acknowledgment post, posting a link to a harmful app and encouraging users to remove their approvals via another malicious app.
Interoperability protocols and cross-chain bridges are crucial for facilitating interaction among various decentralized protocols. However, they have turned into a prime target for malicious individuals. Over the past years, some of the most substantial DeFi exploits were executed on cross-chain bridges.
Published At
1/24/2024 10:55:08 AM
Disclaimer: Algoine does not endorse any content or product on this page. Readers should conduct their own research before taking any actions related to the asset, company, or any information in this article and assume full responsibility for their decisions. This article should not be considered as investment advice. Our news is prepared with AI support.
Do you suspect this content may be misleading, incomplete, or inappropriate in any way, requiring modification or removal?
We appreciate your report.