Hack history / 2023 / Hack or exploit
SushiSwap
Hack or exploit on Apr 9, 2023 · Missing Input Validation
SOURCES AGREE ON DATE AND LOSS · 5 SOURCES
Lost
$3.3M
sources: $2.8M to $3.3M
Returned
$3.3M
100% of the loss, as a source states it
Rank
#564
among thefts by dollars lost
What happened
SushiSwap's RouteProcessor2 contract was exploited due to missing validation of route parameters across Ethereum, BSC, Arbitrum, and Optimism. Attacker created malicious routes directing users to attacker-controlled pools, stealing ~$3.3M.
Details
- Date
- Apr 9, 2023
- Kind
- Hack or exploit
- Method
- Missing Input Validation
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum, Arbitrum, Optimism, BNB Chain, Polygon, Avalanche
- Audit (rekt.news)
- unaudited
After the theft
- Returned by the attacker
- yes, amount not stated
“A total of 885 ETH have been refunded so far.” (SlowMist Hacked)
Related incidents
SushiSwap 2023 · Hack or exploit · $26K
SushiSwap 2021 · Hack or exploit · $104K
SushiSwap 2020 · Hack or exploit · $15K
Astrid Finance 2023 · Hack or exploit · $228K
TIME 2023 · Hack or exploit · $190K
SushiSwap 2021 · Hack or exploit · $104K
SushiSwap 2020 · Hack or exploit · $15K
Astrid Finance 2023 · Hack or exploit · $228K
TIME 2023 · Hack or exploit · $190K
Cite this page
SwanBluechip, "SushiSwap hack, Apr 9, 2023: $3.3M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht1564f8e897/ (data as of 2026-10-31).