SOCKET 2024 Gateway approval exploit
An attacker used an incomplete input-validation path in the Socket Gateway contract to drain assets from Ethereum wallets that had granted approvals to the affected route. SOCKET paused the contracts, removed the route, restored service, and later reported recovering 1,032 ETH.
Incident facts
- Incident title
- SOCKET 2024 Gateway approval exploit
- Bridge
- SOCKET Protocol
- Incident date
- 2024-01-16
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Ethereum
- Affected assets
- USDC, USDT, Unknown
- Attack category
- Cross Chain Contract Exploit
- Reported loss
- Approximately $3.3 million
- Amount confidence
- High
- Loss amount basis
- Independent Security Analysis Corroborated By Contemporaneous Reporting
- Recovery
- Partial Recovery
- Reimbursement
- Announced
- Restart
- Reopened
- Current outcome
- Active After Incident
- Postmortem
- Partial
- Resolution
- Unresolved
- Last reviewed
- 2026-06-15
- Last verified
- 2026-06-15
Amount and valuation
Security analysis and contemporaneous reporting estimated approximately $3.3 million drained from approved wallets.
The recovered 1,032 ETH is tracked separately and is not subtracted from the incident amount field.
assets drained through the affected Socket Gateway routeapproximately $3.3 million
Canonical incident estimate.
Why this remains unresolved
- SOCKET announced a recovery and distribution plan, but final distribution and reimbursement completion are not established in this batch.
Timeline events
SOCKET paused affected contracts after approval exploit2024-01-16
SOCKET reported an incident affecting wallets with approvals to the vulnerable route and paused the affected contracts while investigating and removing the route.
SOCKET restored service after removing the vulnerable route2024-01-17
SOCKET said the affected route had been disabled and normal bridging activity was restored after the incident response.
Event type normalized from legacy descriptive value service_restored.
SOCKET reported recovery of 1,032 ETH2024-01-23
SOCKET reported recovering 1,032 ETH connected to the January 16 incident and said a recovery and distribution plan would follow.
The recovery amount is not treated as proof of final user distribution.
Evidence records
- SOCKET acknowledged the January 16 incidentSOCKET · Tier 1 · High reliability · primary · 2024-01-16Claim scope: Incident Case
Primary incident acknowledgement and pause notice.
- SOCKET incident-response updateSOCKET · Tier 1 · High reliability · primary · 2024-01-17Claim scope: Restart
Primary response update used for the route-removal and restart timeline.
- Socket Tech Incident AnalysisCertiK · Tier 2 · High reliability · secondary · 2024-01-16Claim scope: Incident Case
Independent technical analysis and amount estimate.
- Socket recovered 1,032 ETH following bridge protocol exploitcrypto.news · Tier 2 · High reliability · secondary · 2024-01-23Claim scope: Recovery
Secondary report quoting SOCKET's official recovery announcement.
- SOCKET fund recovery updateSOCKET · Tier 1 · High reliability · primary · 2024-01-23Claim scope: Recovery
First-party update reporting recovery of 1,032 ETH from the January 16 incident and a forthcoming recovery and distribution plan.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- The final fiat value distributed to affected users and completion date require later review.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.