Some Funds Stolen in SushiSwap Exploit Recovered, but Blackhat Hackers Have the Rest

Funds recovered by whitehat security teams to be returned to users while others have been lost to blackhat hackers

article-image

Subbotina Anna/Shutterstock modified by Blockworks

share

SushiSwap is now safe to use after attackers drained more than $3 million last weekend, the blockchain protocol said Wednesday. It is now preparing to return some of the stolen funds to affected users, though not all are expected to recoup their losses quickly. 

Exploiters found an approval bug in SushiSwap’s Route Processor 2 last weekend, taking roughly $3.3 million from the smart contract. 

The majority of addresses that approved SushiSwap’s problematic smart contract were on Arbitrum and Polygon. The contract had been deployed on Arbitrum a few weeks ago for testing.

As part of the exploit, funds got swept by whitehat security teams while some were lost to blackhat hackers, the SushiSwap team said in a tweet. Those who haven’t used SushiSwap in the past 10 days were likely not impacted. 

The company said that user funds in the whitehat contract are safe and will be claimable shortly through a Merkle Claim contract and website the protocol is building. 

SushiSwap users whose funds are not in the whitehat contract must contact the protocol and share the transaction ID and blockchain data for the lost funds.

Loading Tweet..

“Blackhat funds will take longer to process, as the team will have to manually verify the legitimacy against on-chain data that validates the claim and then pay it out accordingly,” SushiSwap tweeted. 

The SushiSwap hack came after the number of crypto attacks spiked during the year’s first quarter, according to a report by Web3 security platform Immunefi. 

Various DeFi protocols that have become victims to such exploits have been able to successfully recover some or all of their stolen funds in recent months.

Scammers often try to trick DeFi users into granting them access to their funds — a method services such as Revok.cash seek to combat. Blockchain security firm PeckShield had urged SushiSwap users who had approved the relevant smart contract to immediately revoke its approval.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates (6).png

Research

In recent months, a number of highly accretive developments were implemented across the protocol to improve fee capture, expand product functionality, and ultimately drive value accrual to the RUNE token, with more upgrades on the immediate horizon. These developments include hiking the minimum swap fee parameter to increase revenue, adding a Burn System Income Lever to reduce the RUNE supply, the addition of COSM-WASM smart contracting and IBC to enable an application layer, new chain integrations, and more.

article-image

A blockchain some thought dead in the water two years ago now feels cool

article-image

Former IRS agent and Binance executive Tigran Gambaryan will remain imprisoned in Nigeria’s Kuje prison

article-image

When Permissionless III wraps on Friday, there will be 26 days left until the 2024 presidential election

article-image

Plus, an update from the ground in Salt Lake City at Permissionless III

article-image

The US regulator accused the crypto market-making firm of acting as an unregistered dealer