Hackers drain $11m from Cetus pool on Sui
Attackers targeted pools on the Cetus DEX on Sui. They siphoned $11 million from the SUI/USDC liquidity pool, triggering price drops of about 75% for most tokens and leaving reserves nearly depleted.
? BREAKING: Cetus, main LP provider DEX on $SUI, allegedly hacked.
$11M in $SUI drained from SUI/USDC pool, with most tokens down 75%+ as pools are emptied. pic.twitter.com/sWKwsZGjaM
— Cointelegraph (@Cointelegraph) May 22, 2025
Cetus is the main liquidity provider platform for the DeFi ecosystem.
The founder of SuiNetwork Africa, known as Nefarii.sui, summarised what is known about the incident:
- the attacker exploited a vulnerability in the Cetus protocol;
- funds worth ~$220 million were affected;
- $160 million have already been frozen and may be recovered—they will be returned to the Cetus liquidity pool;
- the Cetus team and Sui developers are working to recover the remaining $60 million;
- the network itself was not affected;
- Cetus Protocol has fixed the vulnerability and resumed operations.
Over the past hour, SUI fell by almost 5%.
The CETUS token dropped 30%.
The Cetus team confirmed the incident.
?Alert Announcement ?
There was an incident detected on our protocol and our smart contract has been paused temporarily for safety. The team is investigating the incident at the moment. A further investigation statement will be made soon. We are grateful for your patience.
— Cetus? (@CetusProtocol) May 22, 2025
“Anomalous activity detected. Smart contracts temporarily paused. We are investigating the situation. More details will follow later,” — said the DEX.
Part of the Sui community believes the episode is linked not to a hack but to an oracle error—the mechanism responsible for price data.
$CETUS IS NOT HACKED.
BUG IN THE ORACLE.
FALSE ALARM AND I GOT A NICE FUD ENTRY pic.twitter.com/BF905WDs9r
— Lieutenant Ponzi (@LieutenantPonzi) May 22, 2025
Journalist Colin Wu reported that a hacker at address 0xe28b…e8ff06 drained liquidity from several Cetus pools and swapped it for SUI. The address currently holds assets worth ~$150 million, including 12.989 million SUI (~$54 million).
Suiscan shows that the hacker: 0xe28b…e8ff06 drained token liquidity from various Cetus pools and swapped it for SUI. The hacker currently holds assets worth ~$150 million, including 12.989 million SUI (~$54 million).
— Wu Blockchain (@WuBlockchain) May 22, 2025
The attacker is moving funds across chains and converting them to ether. The address on Ethereum holds more than 9,200 ETH (about $24 million), and the sum is still rising, Wu noted.
The hacker is performing cross-chain operations and exchanging them for ETH. Currently, the hacker: 0x89…919b holds more than 9,200 ETH (worth about $24 million) on Ethereum and is still expanding.
— Wu Blockchain (@WuBlockchain) May 22, 2025
Binance founder Changpeng Zhao said he is doing what he can to help Sui.
We are doing what we can to help SUI. Not a pleasant situation. Hope everyone stay SAFU!
— CZ ? BNB (@cz_binance) May 22, 2025
Bluefin, the second-largest DEX on Sui, temporarily paused its spot platform to protect users.
To protect our users, we’ve temporarily paused actions on Bluefin Spot as a precautionary measure. We want to emphasize that Bluefin remains fully secure.
Our team is actively monitoring the situation. Thank you for your trust.
— Bluefin (@bluefinapp) May 22, 2025
Momentum, the ecosystem’s third-largest DEX by volume, suspended all activities as a precaution.
Due to the ongoing exploit on Cetus, we temporarily paused all activities on Momentum as a precautionary measure. All funds are 100% SAFE. We are in communication with the Sui foundation regarding next steps.
— Momentum (@MMTFinance) May 22, 2025
On May 22, on-chain sleuth ZachXBT reported that an unknown party linked to the $300 million theft from Coinbase users swapped $42.5 million in bitcoin for ether via Thorchain.
Рассылки ForkLog: держите руку на пульсе биткоин-индустрии!