Cetus Protocol hack wipes $260M in latest Sui exploit

On May 22, Cetus Protocol (CETUS), the primary decentralized exchange and liquidity provider on the Sui (SUI) blockchain, experienced a major security breach.

Major decentralized exchange and liquidity provider Cetus Protocol (CETUS) on the Sui (SUI) blockchain was breached, and an exploit quickly unfolded, draining an estimated $223 million and immediately disrupting DeFi activity.

The exploit began at 3:52 AM PT (11:52 UTC on May 22) with irregular movements in the SUI/USDC liquidity pool, initially reported as a $11 million outflow.

However, further analysis revealed that the exploit spanned across several pools and may have resulted in a total loss of around $260 million.

The incident unfolded as Cetus, launched in 2023, had become a primary exchange and liquidity provider on the Sui chain, facilitating token swaps and yield farming for more than 62,000 active users. The protocol also generated over $7.15 million in daily trading fees.

SUI, the native token of the Sui blockchain, fell sharply from $4.19 to $3.62 by the time of writing on May 23, marking a nearly 14% drop within a day.

CETUS, the native token of the affected protocol, declined from $0.26 to $0.15 during the immediate aftermath of the breach. Its current price of $0.17 indicates only a partial recovery.

Tokens across the wider ecosystem reacted with similar volatility. Memecoins native to Sui, including LOFI, HIPPO, SQUIRT, SLOVE, and MEMEFI, experienced losses ranging from 51% to 97%. Although prices have since stabilized, investor confidence remains low.

Among the top 15 assets listed on Cetus, more than 75% of the total value was erased. Some tokens, such as LBTC and AXOLcoin, saw their prices collapse to nearly zero.

The broader impact went beyond token prices, with Sui’s total value locked dropping from $2.13 billion to $1.92 billion by the time of writing, highlighting a contraction over a matter of hours.

Let’s delve into how the exploit was carried out, what structural flaws it exposed, and how the community is preparing its response.

Sui hacker triggers liquidity drain on Cetus Protocol

The incident began with a vulnerability in the smart contract system underpinning Cetus’s pricing mechanism.

At the heart of the issue was the protocol’s oracle, designed to provide real-time price data to the platform for enabling fair trading across token pairs. In this case, the oracle served as the entry point for the exploit.

The wallet address involved, identified as “0xe28b50,” deployed spoof tokens such as BULLA to manipulate pricing curves and disrupt reserve balances.

Despite these tokens having minimal real liquidity, they were used to skew internal pool metrics, making valuable assets like SUI and USDC appear undercollateralized. This destabilization of the pricing logic allowed the attacker to extract real tokens from the pools without providing proportional value.

On-chain analysts observed the attacker transferring around $63 million in USDC from Sui to Ethereum (ETH) in the hours following the exploit.

Conversion data showed that $58.3 million was swapped for 21,938 ETH at an average rate of $2,658 per coin. The pace of execution, estimated at approximately $1 million per minute, indicated a coordinated and pre-planned operation.

Cetus initially described the issue as an “oracle bug,” a term that drew immediate criticism from developers and security experts due to the scale and precision of the exploit.

The incident began with an anomaly in the SUI/USDC liquidity pool on Cetus, as reported by blockchain monitor TokenInsight.

At 3:52 AM PT (11:52 UTC), there was a sudden surge in activity, with an abnormal liquidity addition of 10,000 SUI and 3,000,000 USDC.

Almost simultaneously, an equal amount of SUI was removed from the pool, along with 2,999,969 USDC, resulting in a net loss of 31 USDC for the pool.

This transaction was executed by an address that had previously engaged in minimal activity on the chain, starting in March 2023. Prior to the exploit, the wallet held only a small amount of SUI, valued at less than $10.

The incident occurred shortly after Cetus announced a new partnership with blockchain cybersecurity firm Haechi Labs to enhance security measures.

Following the exploit, the administrative team at Cetus announced the suspension of smart contract operations on May 22 at 4:00 AM PT to prevent further outflows from the protocol.

A public statement was posted on the project’s official X account, acknowledging the incident and pledging a full investigation. No