Here’s How SushiSwap Plans to Refund Users After $3.3 Million Hack

Ethereum-based decentralized exchange (DEX) SushiSwap released an update about its plans to return stolen funds to users affected by the $3.3 million exploit over the weekend.

According to an announcement from the exchange’s official Twitter handle, users whose assets were taken by white hat security teams would be refunded quicker than those who lost theirs to the black hat hackers.

The $3.3 Million SushiSwap Hack

Recall that the popular decentralized exchange was exploited through its approval contract on Sunday, April 9. The compromised smart contract, called RouterProcessor2, was used to execute trade routing on the platform.

As CryptoPotato reported, SushiSwap lost 1,800 ether (ETH) tokens worth roughly $3.3 million, and they were drained from a single user named @0xsifu.

When the bug was discovered, SushiSwap deployed whitehat security teams who secured funds from the affected addresses. The protocol also instructed users whose addresses were vulnerable to the exploited contract to revoke the approval immediately to avoid more losses.

While the DEX worked toward resolving the issue, blockchain security firm BlockSec revealed that it blocked one of the hacker’s transactions and rescued 100 ETH worth $186,000. The security firm said its system detected the attack immediately, and its team moved to the rescue.

SushiSwap has updated its web app, fixed the bug, and asked users to continue normal activities. The protocol noted that traders who have not interacted with the exchange in the last ten days were safe as the exploited contract is less than ten days old.

SushiSwap to Compensate Users

For users whose funds are in the whitehat address, SushiSwap disclosed that they would receive their assets through a Merkle Claim contract, which is scheduled to go live soon.

The Sushi team further announced that users affected by the blackhat hackers would have to either submit an email to the protocol or open a ticket in the project’s official Discord channel with information on the transaction IDs and blockchain data of the lost funds.

The protocol will establish an opt-in claims process to manage the claims on a case-by-case basis. The exchange will release detailed steps for the process later.

Our goal is to return all user funds to legitimate claimants. We appreciate everyone’s patience and understand your frustration as we work through returning funds to affected users 🤝

— Sushi.com (@SushiSwap) April 12, 2023