Firstly, we would like to take a moment to thank the entire Socket community, individuals, security partners, and our ecosystem partners for the outpouring of support and patience during the entire recovery process. For a recap of what happened, we have published the incident report here.
The 2024-01-16 security incident resulted in a loss of funds for users had approvals to the contract: 0x3a23F943181408EAC424116Af7b7790c94Cb97a5. Subsequently, all USDC & USDT was swapped into ETH. On 2024-01-23, after a series of negotiations we successfully recovered 1032 ETH on user’s behalf.
Address on Ethereum where the funds were recovered to: https://etherscan.io/address/0xc3a8af8c8bfc263030258afd80eb25afb6ff0820
The Socket smart-contract vulnerability affected 232 users across 5 different asset types, and the total loss amounted to $3.3M USD. However, the funds that were recovered were purely denominated in ETH - worth $2.2m USD at the time of recovery.
Socket is contributing $1.1M USD on top to make all the affected users whole.
We will be distributing all the funds lost to user wallets.
Here is the detailed sheet with the calculated amount for each wallet https://docs.google.com/spreadsheets/d/1qdG4utMvqw-apmp6Lwil1eQ1r4w6NlS7
In order to receive the due funds, users need to sign a message confirming their wallet address and reimbursement amount at: **https://recovery.socket.tech/**
Users can connect to the website above to connect their wallet and sign to complete the recovery. Users will receive funds in their wallet in 10-12 hours after signing.
Please reach out to us on the user hotline for any queries related to the recovery process.
<aside> 👇 Please follow steps in the page for the tutorial/FAQs regarding the process
</aside>
IMPORTANT SECURITY NOTE:
We sincerely appreciate your support and understanding as we navigated this incident and work towards building a better Socket. We are here for the long term and committed to deliver the best cross-chain experience and reward our loyal users.