Brother
Professional
- Messages
- 2,590
- Reaction score
- 483
- Points
- 83
The team at cross-chain bridge aggregator Socket reported an attack that resulted in the protocol losing $3.3 million.
“There was a security incident at Socket that affected infinite contract approval wallets. We have identified the issue and have suspended the affected contracts,” the developers wrote.
They advised users to revoke all approvals for safety reasons.
The exploit was initially discovered by a researcher under the nickname Spreek.
“Several million have already left. The attack continues,” he noted, indicating the address of the attacker.
He also advised to revoke approvals, but to be careful and only use verified links.
Less than an hour later, the expert stated that transactions to the hacker’s wallet had stopped.
“I think this pause has corrected the situation; most likely, attacks are no longer possible. So if you're worried about a recall right now, you can probably relax,” Spreek concluded.
According to PeckShield experts, the exploit was the result of “incomplete verification of user input,” which was used to steal funds from those who approved the vulnerable SocketGateway contract.
The attacker created the path for the attack three days before the incident by deploying the contract.
“There was a security incident at Socket that affected infinite contract approval wallets. We have identified the issue and have suspended the affected contracts,” the developers wrote.
They advised users to revoke all approvals for safety reasons.
The exploit was initially discovered by a researcher under the nickname Spreek.
“Several million have already left. The attack continues,” he noted, indicating the address of the attacker.
He also advised to revoke approvals, but to be careful and only use verified links.
Less than an hour later, the expert stated that transactions to the hacker’s wallet had stopped.
“I think this pause has corrected the situation; most likely, attacks are no longer possible. So if you're worried about a recall right now, you can probably relax,” Spreek concluded.
According to PeckShield experts, the exploit was the result of “incomplete verification of user input,” which was used to steal funds from those who approved the vulnerable SocketGateway contract.
The attacker created the path for the attack three days before the incident by deploying the contract.
