SushiSwap Pays $200K Bounty to Recover $600K Stolen by Hackers

Stolen funds will be redistributed to users once SushiSwap completes an audit for its Merkle claim contract


David Sandron/Shutterstock modified by Blockworks


Decentralized exchange SushiSwap has been able to recover an additional $600,000 in crypto stolen from users earlier this month.

In the initial exploit, SushiSwap’s new router, RouterProcessor2, was attacked. The router had been deployed to 14 different blockchain networks.

Crypto worth more than $3.3 million at the time was drained, mostly ETH belonging to DeFi figure 0xSifu, and ​​any users who had approved the relevant smart contract in their wallets were urged to immediately revoke approval.

As the smart contract was not upgradeable, a temporary fix was difficult to implement. Blockchain security startup HYDN helped SushiSwap pick up the pieces after the attack. 

SushiSwap disabled its frontend to prevent more users from depositing assets into the pool, but the smart contract remained operational, Warren Mercer, the CEO of HYDN, told Blockworks.

“​​The only two options were really to alert users to the issue and ask them to remove approvals or to perform a whitehat rescue to save funds,” Mercer said.

A decision was made to front-run any further attacks and transactions. A “whitehat rescue” was determined as the best way forward, draining vulnerable funds before they could be stolen.  

In last year’s Multichain attack, the culprits ended up piling after users were alerted to the situation. HYDN and SushiSwap hoped to avoid a similar scenario.

While the rescue played out, another whitehat hacker who had reported the same bug through Immunefi attempted to recover 100 ETH themselves, Mercer notes.

“Unfortunately, he didn’t use a private mempool, so MEV bots detected his whitehat attempt in the public mempool who then replicated the attack and began stealing user funds,” he said.

In response to this, HYDN was tasked with quickly performing its whitehat attack. It began sequestering funds and deploying a ‘cross-chain watcher’ contract to protect against further attacks. SushiSwap paid the firm a $200,000 bounty for their efforts.

“To date, we have managed to rescue over $600.000 in user funds for Sushi, with the Sushi team managing to also gain back a large portion of the stolen funds,” Mercer said. Other amounts of ETH had been recovered directly following the attack.

Secured funds are still sitting in HYDN’s wallet, and funds will be distributed to affected users once SushiSwap completes a contract audit.

SushiSwap has so far retrieved a total of 885 ETH ($1.76 million). Another 795 ETH ($1.58 million) is kept in a rewards vault for the time being.

Don’t miss the next big story – join our free daily newsletter.


Upcoming Events

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

ao cover.jpg


Arweave recently launched the testnet for AO computer, a new messaging protocol that will sit atop a PoS network and aims to become a scalable global compute platform through parallel processing and modularity.


The “fastest-growing ETF in history” has seen net inflows on every trading day since its Jan. 11 launch


Relm and Chainproof will provide insurance quotes to distributed validators


DLC.Link uses a Taproot-based Bitcoin multisig to let institutions mint dlcBTC, starting on Arbitrum


Pre-seed Bitcoin startup deals rose 360% in 2023, a TVP report shows


Circle’s new smart contract to allow holders of BlackRock USD Institutional Digital Liquidity Fund to redeem shares for its stablecoin


Uniswap says it was not surprised to receive a Wells notice given the SEC’s “abusive” use of power as of late