Sodium Wallet exploit drains 11.76 ETH from 300 Arbitrum accounts
Security & Exploits ·
An access-control flaw in Sodium's ERC-4337 signature validation let an attacker withdraw gas deposits from 300 wallets on Arbitrum without proper authorization.
The attacker exploited a bug in the wallet's smart contract validation path, using a self-chosen session key to pass signature checks meant to restrict withdrawals to legitimate owners. By manipulating this access-control logic, the attacker was able to drain gas deposits — funds users had set aside to cover transaction fees — from 300 separate wallets in a single operation. The activity associated with the exploit can be traced on-chain through the address flagged in connection with the incident, visible on Arbiscan.
The total drained came to 11.76 ETH, a relatively small sum spread thin across a large number of victims rather than concentrated in a few large withdrawals. That distribution pattern is consistent with an automated exploit targeting a systemic flaw in the wallet's contract logic rather than a targeted attack on individual users.
A separate account of the same incident places the loss at approximately $21.2K, tied to the same signature-validation bypass affecting more than 300 user wallets — corroborating both the mechanism and the approximate scale of the breach across independent reporting.
ERC-4337, the account-abstraction standard underpinning smart contract wallets like Sodium's, is designed to allow flexible transaction validation logic, including session keys and alternative signature schemes. That flexibility is also where this vulnerability originated: an access-control gap in how the contract verified which keys were authorized to trigger withdrawals, rather than a flaw in the underlying cryptography itself.
It remains unclear whether Sodium has patched the underlying validation bug, whether affected users will be reimbursed, or whether additional wallets beyond the 300 identified were exposed to the same exploit path. The precise timeline of the attack and whether funds have moved beyond the flagged address have also not been detailed.