2024

Million

Blockchain interoperability protocol Socket reported a security breach on Tuesday that resulted in over $3.3 million in losses. The incident impacted wallets that had granted infinite approvals to Socket contracts. It was attributed to a vulnerability in user input validation.
The exploit was linked to a specific route in the system that had been added just three days before the attack. As per blockchain security firm PeckShield, the problematic route has since been deactivated to prevent further misuse.
<h2 id="span-data-preserver-spaces-true-socket-identified-the-issue-span">Socket identified the issue</h2>
In response to the&nbsp;<a class="editor-rtfLink" href="https://coingape.com/sec-x-hack-what-really-caused-the-big-blunder/" target="_blank" rel="noopener noreferrer nofollow">breach</a>, Socket said it has identified the vulnerability in user input validation. The&nbsp;<a class="editor-rtfLink" href="https://coingape.com/crypto-exploit-gamma-strategies-halts-deposits-after-3-4m-hack/" target="_blank" rel="noopener noreferrer nofollow">hack</a>&nbsp;affected its Bungee bridging aggregator.
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Today's hack on <a href="https://twitter.com/SocketDotTech?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@SocketDotTech</a> results in the loss of &gt;$3.3m.
 The bad route exploited in the hack was added 3 days ago and is now disabled. Here are related txs: – add route tx: <a href="https://t.co/lxw7iA1kn4" rel="noopener noreferrer nofollow">https://t.co/lxw7iA1kn4</a> – disable route tx:<a href="https://t.co/QMHfI4YeuU" rel="noopener noreferrer nofollow">https://t.co/QMHfI4YeuU</a>
 The hack is due to… <a href="https://t.co/QdBBgVF287" rel="noopener noreferrer nofollow">https://t.co/QdBBgVF287</a> <a href="https://t.co/yNxF5vCwax" rel="noopener noreferrer nofollow">pic.twitter.com/yNxF5vCwax</a>
 — PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1747353782004900274?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">January 16, 2024</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
&nbsp;
Socket acknowledged the breach and informed users of the action taken to address the situation. The company paused the affected contracts and reassured users that no further actions were needed on their part. The response aimed to limit the impact and protect user assets.
Hacken, another cybersecurity firm, confirmed that the vulnerability stemmed from a recently deployed contract. They identified the issue as an incomplete validation of user input, which allowed attackers to exploit the contracts for unauthorized fund transfers.
Meanwhile, blockchain developer Francesco Andreoli&nbsp;<a rel="noopener noreferrer nofollow" class="editor-rtfLink" href="https://twitter.com/francescoswiss/status/1747397058426724514" target="_blank">noted</a>&nbsp;in a post, “Happy to report that users of @MetaMask swaps are safe from the current Socket Gateway hack. We’ll probably be writing a bit more soon about how our architecture allowed us to integrate Socket without being vulnerable to it.”
That said, the incident highlights the need for smart contract security as&nbsp;<a class="editor-rtfLink" href="https://coingape.com/just-in-defi-security-suffers-another-hit-with-wise-lending-hack/" target="_blank" rel="noopener noreferrer nofollow">DeFi</a> evolves. Not only does it call for rigorous security protocols, but decentralized applications require constant vigilance to protect user assets.
Crypto investor Ryan S. Adams, known as rsa.eth on X,&nbsp;<a rel="noopener noreferrer nofollow" class="editor-rtfLink" href="https://twitter.com/RyanSAdams/status/1747362114992324886" target="_blank">shared</a>&nbsp;his concerns as a “crypto native” in the context of a recent security breach. His tweets reflect the anxiety and challenges faced by individuals heavily invested in the cryptocurrency ecosystem, particularly during security incidents.
He noted, “Why can’t our wallets auto-revoke for us…why can’t they alert us when there’s an issue like this? We need protection against bugs and phishing inside our wallets.”
Also Read:&nbsp;<a class="editor-rtfLink" href="https://coingape.com/scam-alert-crypto-hackers-exploit-fake-nft-game-to-drain-funds/" target="_blank" rel="noopener noreferrer nofollow">Crypto Scam Alert: Hackers Exploit Fake NFT Game To Drain Funds</a>
The post <a href="https://coingape.com/socket-loses-3-3-million-in-hack-due-to-input-validation-flaw/" rel="noopener noreferrer nofollow">Socket Loses $3.3 Million in Hack Due to Input Validation Flaw</a> appeared first on <a href="https://coingape.com" rel="noopener noreferrer nofollow">CoinGape</a>.

Socket Loses $3.3 Million in Hack Due to Input Validation Flaw

Table of Contents

Coingape News Media

Other articles published on Jan 17, 2024

Jamie Dimon Sees Value in Blockchain, Calls Bitcoin a ‘Pet Rock’

Ripple CTO Says Debt Box Defendants Have a Strong Case Against the SEC

Concordium Announces Its First Oracle Integration With Umbrella To Enhance Security Of Web3 Infra...

Top Three Companies Command 90% of the Bitcoin ETF Market, Who Are They?

Polygon (MATIC) Faces Critical Resistance Trendline, With Two Possible Scenarios

7.6 Million Polygon (MATIC) Transferred by Unknown Wallet: Details

Join our free newsletter for daily crypto updates!