Jay Pegs Auto Mart (SushiSwap MISO) hack — September 2021

On 17 September 2021 the proceeds of a token auction run on MISO, SushiSwap's launchpad, were redirected to an attacker's wallet. The auction was for DONA, the token of Jay Pegs Auto Mart, an NFT project styled as a used-car dealership selling Kia Sedona-themed NFTs. This was not a smart-contract exploit. Someone with commit access pushed a change to the MISO front-end repository that replaced the auction's destination wallet with an address they controlled. SushiSwap's post-mortem states the malicious change reached master because the required review process "was not enforced by git branch protection settings", and that 865 ETH reached the exploit address. The dollar figure varies with the conversion used. CoinDesk put the amount at 864.8 ETH, worth about $2.93 million at the time; The Defiant reported the same ETH figure at roughly $3.1 million. All of it was returned. Sushi's post-mortem records that "the full funds were returned to the operational multisig after a period of discussion in quantities of 100 ETH, 700 ETH, and 65 ETH." The post-mortem also describes the remediation: enforcing git branch protections and integrating LavaMoat. The attribution comes from the victim's side, not from SushiSwap. The Jay Pegs team told CoinDesk it identified the person behind the commit, brought in an attorney to press the legal consequences, and settled privately rather than going to law enforcement, because it feared agencies would seize the ETH rather than return it — one developer said "we settled it amongst ourselves, we're not NARCs." CoinDesk reports the team named a pseudonymous developer, "Eratos", and that he subsequently posted a tweet appearing to distance himself from the hack. The Defiant describes the identification as circumstantial: the team confronted the person they believed responsible, he denied everything, and they relied on a linked sock-puppet account to build their case. SushiSwap's post-mortem names no suspect. No charges were reported.