Socket bridge victims will be made whole

The Socket Tech team negotiated the return of stolen ETH from hacker

article-image

helen_g/Shutterstock modified by Blockworks

share

Socket Tech, a blockchain interoperability protocol, has announced a compensation plan for those affected by the Jan. 16 security incident that occurred on their network.

The exploit was more limited in scope than originally thought — affecting only 232 users — but those affected lost about $3.3 million in assets.

The team announced in a Thursday blog post that “a series of negotiations” with the hacker resulted in the recovery of 1032 ether (ETH) — about $2.3 million at current prices. ETH itself is down about 11% since the time of the incident, alongside the broader crypto market.

Read more: Socket Tech security breach affects multiple dapps and wallets

Socket is making up the difference in USD terms, distributing $1.1 million to affected wallets. Users will have to sign an on-chain message to prove wallet ownership, but importantly — given the nature of the original exploit — recipients do not need to grant any approvals to claim reimbursement.

Loading Tweet..

The original exploit targeted a subset of users who had granted unlimited approvals to tokens in their wallets — a common, if misguided, phenomenon in DeFi.

Read more: $80M lost in first hack of 2024

The concern was heightened by the fact that many users were unaware they were utilizing Socket Protocol in the first place. This protocol is commonly used behind the scenes to bridge the Ethereum network with over a dozen other blockchains that utilize EVM (Ethereum Virtual Machine) infrastructure.

In its post-mortem on the incident, Socket noted that since they “default to finite approvals within Socket API, Socket Plugin [and] bungee.exchange, the damage was limited.”

Multiple security researchers collaborated on the recovery, including Seal911, Slowmist, and Hexagate.

Read more: Blockchain security experts team up to improve industry threat response

The official link to claim, according to the post, is recovery.socket.tech.

Nefarious parties will likely seek to exploit naive users, prompting Socket to conclude with a warning:

“We expect scammers to send out fake phishing links. Refrain from clicking on any 3rd party links.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research

article-image

Judge Analisa Torres said the parties have not demonstrated that vacating her prior ruling is in the best interest of the public

article-image

Prediction markets have found a mainstream fit

article-image

Money for enemies isn’t fun, but crypto can be

article-image

Onchain SOL perps wiped $31 million, outpacing CEX volumes two days in a row

article-image

Fed Chair Jerome Powell told Senators Wednesday that the timeline on lowering interest rates is up in the air

article-image

Credit infrastructure DeFi protocol Grove makes allocation into a CLO segment “ripe for movement into DeFi”