Socket bridge victims will be made whole

The Socket Tech team negotiated the return of stolen ETH from hacker

article-image

helen_g/Shutterstock modified by Blockworks

share

Socket Tech, a blockchain interoperability protocol, has announced a compensation plan for those affected by the Jan. 16 security incident that occurred on their network.

The exploit was more limited in scope than originally thought — affecting only 232 users — but those affected lost about $3.3 million in assets.

The team announced in a Thursday blog post that “a series of negotiations” with the hacker resulted in the recovery of 1032 ether (ETH) — about $2.3 million at current prices. ETH itself is down about 11% since the time of the incident, alongside the broader crypto market.

Read more: Socket Tech security breach affects multiple dapps and wallets

Socket is making up the difference in USD terms, distributing $1.1 million to affected wallets. Users will have to sign an on-chain message to prove wallet ownership, but importantly — given the nature of the original exploit — recipients do not need to grant any approvals to claim reimbursement.

Loading Tweet..

The original exploit targeted a subset of users who had granted unlimited approvals to tokens in their wallets — a common, if misguided, phenomenon in DeFi.

Read more: $80M lost in first hack of 2024

The concern was heightened by the fact that many users were unaware they were utilizing Socket Protocol in the first place. This protocol is commonly used behind the scenes to bridge the Ethereum network with over a dozen other blockchains that utilize EVM (Ethereum Virtual Machine) infrastructure.

In its post-mortem on the incident, Socket noted that since they “default to finite approvals within Socket API, Socket Plugin [and] bungee.exchange, the damage was limited.”

Multiple security researchers collaborated on the recovery, including Seal911, Slowmist, and Hexagate.

Read more: Blockchain security experts team up to improve industry threat response

The official link to claim, according to the post, is recovery.socket.tech.

Nefarious parties will likely seek to exploit naive users, prompting Socket to conclude with a warning:

“We expect scammers to send out fake phishing links. Refrain from clicking on any 3rd party links.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates (2).png

Research

We’re bullish on the PUMP token. We believe Pump.fun's brand strength, existing integrations, product roadmap, and strategic levers justify PUMP's TGE valuation, and expect the token to re-rate meaningfully higher in the months ahead.

article-image

Crypto’s highest purpose might be to make markets better by making them bigger

article-image

The non-profit’s “Project Open” seeks to let stocks trade directly on Solana

article-image

The acquisition is Pump.fun’s first, and comes just days before its planned ICO

article-image

As Trump’s tariff war reignites, everyone is assuming the dollar will continue its path lower. But the journey might be bumpy

article-image

A valuation model for “blockchain GDP”

article-image

The mini app combines vibe-coding with a hypercasual game feed and is coming to the new Coinbase Wallet