Socket Tech Incident Analysis

On 16 January 2024 an attacker exploited a recently added router (routeAddress 0xcc5f) in the Socket gateway by supplying malicious swapExtraData to the performAction function, which used an unvalidated .call() and allowed arbitrary execution that invoked transferFrom on tokens users had previously approved to the SocketGateway. The exploit involved two attacker contracts and drained assets from 230 wallets (notable losses include ~3.3M by the largest victim and ~2.5M USDC from 127 victims), with stolen funds consolidated in the exploit wallet; Socket disabled the vulnerable route after the abuse was detected.