<p>Socket, a cross-chain infrastructure protocol, and its interoperability bridging platform, Bungee, have restarted operations following a temporary pause prompted by an exploit that led to the apparent theft of $3.3 million.</p><h2 id="header-0">Security incident</h2><p>Taking to the company’s Discord, Socket team hospitality lead Taylor Melvin clarified that it had “experienced a security incident which affected wallets with infinite approvals to Socket contracts.”</p><p>The incident, which occurred on Tuesday, involved an unknown attacker draining millions worth of stablecoins and other tokens from the Bungee bridging aggregator. The attackers targeted wallets with infinite approvals to Socket contracts, exploiting authorizations for blockchain-based tools that allow applications to access tokens in a user’s wallet.</p><p>Security researcher “&#64;speekaway” was the first to <a href="https://x.com/spreekaway/status/1747337879771033632?s&#61;20" rel="noopener noreferrer nofollow">flag</a> the exploit on Tuesday. The attacker’s wallet, connected to the exploit, held nearly $3 million in ether (ETH) and $300,000 worth of other tokens. By 2:47 p.m. ET, the attack seemed to have ceased, with the researcher recommending users to revoke approvals for Socket to safeguard their assets.</p><h2 id="header-1">Pausing contracts</h2><p>In response to the security breach, Socket <a href="https://x.com/SocketDotTech/status/1747349422730813525?s&#61;20" rel="noopener noreferrer nofollow">announced</a> the pause of affected contracts on Tuesday at 3:15 p.m. ET. The project’s team promptly identified and addressed the issue, taking swift action to mitigate the exploit’s impact.</p><p>&#64;speekaway chimed back in once contracts had been paused, <a href="https://x.com/spreekaway/status/1747347958683574390?s&#61;20" rel="noopener noreferrer nofollow">writing</a>:</p><p>”Think this pause fixed it, very likely no more attacks are possible. So if you are currently freaking out about revoking you can probably relax.”</p><h2 id="header-2">Normal service returns</h2><p>As Socket paused activity during the incident, preventing further propagation of the attack, developers worked to fix the issue. Early Wednesday, Socket developers <a href="https://x.com/SocketDotTech/status/1747444569812435267?s&#61;20" rel="noopener noreferrer nofollow">announced</a> that the problem had been resolved, and normal activities had resumed. The team also stated that plans for compensation were in progress.</p><p>Cross-chain bridges, like Socket’s Bungee, facilitate token transfers between different blockchains but remain susceptible to exploitation. Blockchain security and data analytics company PeckShield <a href="https://x.com/peckshield/status/1747353782004900274?s&#61;20" rel="noopener noreferrer nofollow">confirmed</a> that at least $3.3 million had been lost, highlighting the need for enhanced security measures in the rapidly evolving blockchain ecosystem.</p><p>The exploit involved the exploitation of a recently added route, which has since been disabled. The attacker targeted users who had over-approved Socket, draining funds up to the limit of their approval.</p><p>This incident follows the $81 million hack of Orbit Chain, a cross-chain bridge connecting Ethereum to other networks, earlier in January. Cross-chain tools’ complexity contributes to the frequency of such attacks, emphasizing the importance of understanding the security measures in place when utilizing these bridges.</p><p>In a <a href="https://www.coindesk.com/tech/2024/01/17/socket-bungee-restart-operations-after-apparent-33m-exploit/" rel="noopener noreferrer nofollow">message</a> to CoinDesk, Sergey Nazarov, co-founder of Chainlink, emphasized the need for users to scrutinize the security of their chosen bridge, considering the various levels of cross-chain security. With the complexities involved, users are encouraged to be vigilant and informed about the security spectrum of the bridges they employ.</p><p>Socket was founded by Indian duo Rishabh Khurana and Vaibhav Chellani. In September, the company <a href="https://coinnesslive.page.link/YVtKXTZ43ZbSCA2C7" rel="noopener noreferrer nofollow">raised</a> $5 million, with funding coming from Framework Ventures and Coinbase Ventures.</p>

Socket’s Bungee resumes operations following exploit

Table of Contents

CoinNess Global

Other articles published on Jan 18, 2024

Reddit looking to launch IPO by March

Polygon’s Transfer Troubles: Is MATIC Facing A Trust Crisis?

Introducing .box – The World’s First Blockchain Native, DNS Routable Domain

SEC’s Gary Gensler Warns Over AI ‘Monoculture’ Risks to Finance Sector

Vote Now: AAVE Sets Deadline for BNB Chain Launch Decision

Cardano (ADA) Price Analysis: Is a Breakout Coming After 35-Day Pattern?

Join our free newsletter for daily crypto updates!