SushiSwap Pays $200K Bounty to Recover $600K Stolen by Hackers

Stolen funds will be redistributed to users once SushiSwap completes an audit for its Merkle claim contract

article-image

David Sandron/Shutterstock modified by Blockworks

share

Decentralized exchange SushiSwap has been able to recover an additional $600,000 in crypto stolen from users earlier this month.

In the initial exploit, SushiSwap’s new router, RouterProcessor2, was attacked. The router had been deployed to 14 different blockchain networks.

Crypto worth more than $3.3 million at the time was drained, mostly ETH belonging to DeFi figure 0xSifu, and ​​any users who had approved the relevant smart contract in their wallets were urged to immediately revoke approval.

As the smart contract was not upgradeable, a temporary fix was difficult to implement. Blockchain security startup HYDN helped SushiSwap pick up the pieces after the attack. 

SushiSwap disabled its frontend to prevent more users from depositing assets into the pool, but the smart contract remained operational, Warren Mercer, the CEO of HYDN, told Blockworks.

“​​The only two options were really to alert users to the issue and ask them to remove approvals or to perform a whitehat rescue to save funds,” Mercer said.

A decision was made to front-run any further attacks and transactions. A “whitehat rescue” was determined as the best way forward, draining vulnerable funds before they could be stolen.  

In last year’s Multichain attack, the culprits ended up piling after users were alerted to the situation. HYDN and SushiSwap hoped to avoid a similar scenario.

While the rescue played out, another whitehat hacker who had reported the same bug through Immunefi attempted to recover 100 ETH themselves, Mercer notes.

“Unfortunately, he didn’t use a private mempool, so MEV bots detected his whitehat attempt in the public mempool who then replicated the attack and began stealing user funds,” he said.

In response to this, HYDN was tasked with quickly performing its whitehat attack. It began sequestering funds and deploying a ‘cross-chain watcher’ contract to protect against further attacks. SushiSwap paid the firm a $200,000 bounty for their efforts.

“To date, we have managed to rescue over $600.000 in user funds for Sushi, with the Sushi team managing to also gain back a large portion of the stolen funds,” Mercer said. Other amounts of ETH had been recovered directly following the attack.

Secured funds are still sitting in HYDN’s wallet, and funds will be distributed to affected users once SushiSwap completes a contract audit.

SushiSwap has so far retrieved a total of 885 ETH ($1.76 million). Another 795 ETH ($1.58 million) is kept in a rewards vault for the time being.


Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the Forward Guidance newsletter.

Get alpha directly in your inbox with the 0xResearch newsletter — market highlights, charts, degen trade ideas, governance updates, and more.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.

Tags

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 18 - 20, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Flashnote Template (6).png

Research

Trading of the President's TRUMP memecoin sent the market capitalization to over $15B, resulting in all-time highs for Solana’s Real Economic Value, DEX volumes, and stablecoin supply. This event further validates Solana as the venue for high-throughput onchain activity, with Solana DEXs and DeFi applications as primary beneficiaries, while also signaling to further experimentation, utilization, and adoption of memecoins as legitimate financial instruments for speculation, crowdfunding, or capital formation. President Trump’s continued willingness to experiment in crypto reaffirms a highly-favorable political and regulatory climate for the industry.

article-image

Back in 2021, there were really only two memecoins and both hit enormous peaks along with BTC

article-image

Polygon Labs CEO Marc Boiron thinks that yield-bearing stablecoins could be the next big narrative

article-image

A Nova Labs exec referred to the last-day lawsuit “as irresponsible as it is wrong-headed”

article-image

Corresponding resolutions were introduced to “roll back the disastrous” rule requiring custodial brokers to report transactions

article-image

Donald Trump has slightly backed off from the ambitious tariff goals he touted on the campaign trail

article-image

Some have called it “a relief” that the task force will be led by the crypto-friendly Hester Peirce