Socket bridge victims will be made whole

The Socket Tech team negotiated the return of stolen ETH from hacker

article-image

helen_g/Shutterstock modified by Blockworks

share

Socket Tech, a blockchain interoperability protocol, has announced a compensation plan for those affected by the Jan. 16 security incident that occurred on their network.

The exploit was more limited in scope than originally thought — affecting only 232 users — but those affected lost about $3.3 million in assets.

The team announced in a Thursday blog post that “a series of negotiations” with the hacker resulted in the recovery of 1032 ether (ETH) — about $2.3 million at current prices. ETH itself is down about 11% since the time of the incident, alongside the broader crypto market.

Read more: Socket Tech security breach affects multiple dapps and wallets

Socket is making up the difference in USD terms, distributing $1.1 million to affected wallets. Users will have to sign an on-chain message to prove wallet ownership, but importantly — given the nature of the original exploit — recipients do not need to grant any approvals to claim reimbursement.

Loading Tweet..

The original exploit targeted a subset of users who had granted unlimited approvals to tokens in their wallets — a common, if misguided, phenomenon in DeFi.

Read more: $80M lost in first hack of 2024

The concern was heightened by the fact that many users were unaware they were utilizing Socket Protocol in the first place. This protocol is commonly used behind the scenes to bridge the Ethereum network with over a dozen other blockchains that utilize EVM (Ethereum Virtual Machine) infrastructure.

In its post-mortem on the incident, Socket noted that since they “default to finite approvals within Socket API, Socket Plugin [and] bungee.exchange, the damage was limited.”

Multiple security researchers collaborated on the recovery, including Seal911, Slowmist, and Hexagate.

Read more: Blockchain security experts team up to improve industry threat response

The official link to claim, according to the post, is recovery.socket.tech.

Nefarious parties will likely seek to exploit naive users, prompting Socket to conclude with a warning:

“We expect scammers to send out fake phishing links. Refrain from clicking on any 3rd party links.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (11).png

Research

Union’s technical design brings measured improvements to crosschain interoperability. By combining a consensus-verified hub with novel constructs like state lenses and ZK proofs for client updates, Union achieves an interoperability protocol that is highly performant, trust-minimized, and scalable.

article-image

The US regulator will use Nasdaq’s system to detect manipulation across derivatives and prediction markets

by Blockworks /
article-image

SOL and HYPE have rebounded, dYdX course corrects (again)

article-image

Over 100 crypto firms and advocates urge Congress to shield open-source builders and non-custodial providers

by Blockworks /
article-image

The probabilities app is finding mainstream success

article-image

A stock by any other name — even “token” — is still a security

article-image

“Diverse opportunities emerge alongside macroeconomic tailwinds,” zondacrypto CEO says