SushiSwap Suffers $3.3M Exploit; Some Funds Being Recovered

1,800 $ETH Lost, 100 $ETH Recovered

Multi-chain Decentralized Exchange (DEX) SushiSwap suffered an exploit over the weekend that resulted in the loss of 1,800 $ETH, worth more than $3.3 million.

A white-hat recovery process is ongoing and had secured some 100 $ETH, worth about $180,000, as of Monday.

Security firm Peckshield flagged the exploit of a bug in Sushi’s “RouterProcessor2” contract early in the morning on Easter Sunday. Apparently the lost funds belonged to a single trader @0xSifu.

Sushi Head Chef Jaredy Grey and other members of the team advised users to immediately revoke RouteProcessor2 token permissions in their wallets. Sushi developer Matthew Lilley said on Sunday afternoon that exposure to the flawed contract had been removed and the DEX and its liquidity pools were safe to use again.

DefiLlama developer @0xngmi said wallets that had Sushi approvals as far back as two weeks ago might be vulnerable to the exploit.

Early Monday morning, the official Sushi account posted a Twitter thread summing up the current status of the exploit and recovery efforts.