CETUS協議被利用，導致數字資產損失超過2.23億美元

CETUS協議是SUI區塊鏈上最大的分散交換和流動性平台，遭受了毀滅性的剝削，導致損失

The DeFi world was rocked today by the exploit of Cetus Protocol, a leading decentralized exchange and liquidity platform on the Sui blockchain. In an attack that began on May 22, 2025, hackers stole digital assets worth more than $223 million from Cetus.

Defi World今天被SUI區塊鏈上領先的分散交流和流動性平台CETUS協議的漏洞震撼。在2025年5月22日開始的一次襲擊中，黑客從Cetus偷走了價值超過2.23億美元的數字資產。

The exploit, which involved the creation of spoof tokens and the abuse of liquidity pool mechanics, is one of the most significant DeFi breaches in recent times and has triggered widespread disruption across the nascent Sui ecosystem.

涉及創建欺騙令牌和濫用流動性池機械師的漏洞利用是近來最重大的違規行為之一，並且在新生的SUI生態系統中引發了廣泛的破壞。

It is the latest in a series of major crypto theft incidents, including the $71 million theft from the STEPN move-to-earn protocol in January 2025 and the $41 million theft from the Animoca Brands Ronin Network in November 2024.

這是一系列重大加密盜竊案中的最新事件中的最新事件，包括2025年1月的Stepn移居歐文協議的7100萬美元盜竊，以及2024年11月的Animoca Brands Ronin Network的4100萬美元盜竊。

According to reports by several blockchain analytics firms, the Cetus Protocol exploit began with the insertion of spoof tokens into the protocol’s liquidity pools.

根據幾家區塊鏈分析公司的報導，CETUS協議的利用始於將欺騙令牌插入協議的流動性池中。

One analysis by Chainalysis identified a key spoof token used in the attack as “BULLA.” Commencing with an initial deposit of 100,000 BULLA tokens, the hackers engaged in a series of rapid transactions to inflate the token’s value.

一項通過鏈分析的分析確定了在攻擊中用作“ Bulla”的關鍵欺騙令牌。從初始存款開始的100,000個Bulla代幣開始，黑客進行了一系列快速交易，以膨脹令牌的價值。

Cetus’s automated market maker (AMM), a core engine of the exchange, was manipulated by these actions. In the process of attempting to maintain price equilibrium, the protocol executed asset swaps that exchanged SUI and USDC tokens for BULLA at unbalanced rates.

CETUS的自動化做市商（AMM）是交易所的核心引擎，被這些行動操縱。在試圖維持價格均衡的過程中，該協議執行了以不平衡的價格將SUI和USDC代幣交換為Bulla的資產掉期。

As a result, the hackers were able to withdraw SUI and USDC tokens in disproportionately large amounts, while the liquidity providers who engaged in these trades sustained significant losses.

結果，黑客能夠以不成比例的大量撤回SUI和USDC令牌，而從事這些行業的流動性提供者卻遭受了巨大的損失。

CoinDesk reported that the exploit also involved vulnerabilities in the pricing oracle used by Cetus. This enabled the malicious actors to distort price feeds on the platform, further aiding them in their gains and rendering internal risk mechanisms at Cetus largely ineffective.

Coindesk報告說，該利用還涉及Cetus使用的定價甲骨文中的漏洞。這使惡意演員能夠在平台上扭曲價格供應，從而進一步幫助他們獲得收益，並在CETUS的內部風險機制基本上無效。

According to reports by Behainal and email correspondence from Cetus, the exploit was premeditated and technically sophisticated. It involved several layers of vulnerabilities that were carefully prepared for and exploited over a period of several weeks.

根據CETUS的Behainal和電子郵件信件的報導，該漏洞利用是有預謀和技術精緻的。它涉及幾層漏洞，這些漏洞是在幾週的時間內精心準備和利用的。

The primary stage of the exploit is believed to have started on May 10, 2025, with the generation of the spoof tokens and their integration into Cetus’s smart contracts.

據信，漏洞利用的主要階段是在2025年5月10日開始的，隨著欺騙令牌的產生及其整合到Cetus的智能合約中。

Later, on May 22, 2025, the main phase of the exploit unfolded as the hackers rapidly executed a series of transactions to manipulate the AMM and siphon off funds.

後來，2025年5月22日，當黑客迅速執行一系列交易以操縱AMM和Siphon資金時，剝削的主要階段展開了。

In total, the hackers executed around 300 transactions within a short time frame, which suggests that they might have been using bots or other automated tools to carry out the exploit undetected until the damage was already done.

總的來說，黑客在短時間內執行了大約300次交易，這表明他們可能一直在使用機器人或其他自動化工具來執行未檢測到的漏洞利用，直到損壞已經造成損壞為止。

The immediate aftermath of the breach saw a dramatic market response. CETUS, the native token of the platform, plummeted more than 40%. Other Sui-based tokens, such as LOFI and Hippo, saw losses of over 80%, and the USDC stablecoin on Sui briefly lost its peg, dipping to $0.99.

違規後的直接後果產生了巨大的市場反應。平台的本地令牌Cetus暴跌了40％以上。其他基於SUI的令牌，例如Lofi和Hippo，損失超過80％，SUI上的USDC Stablecoin短暫失去了釘子，降至0.99美元。

Cetus’s total value locked (TVL) also took a hit, plunging by over $200 million as investors quickly pulled out their liquidity.

CETUS的總價值鎖定（TVL）也受到了打擊，隨著投資者迅速撤出流動性，超過2億美元。

The breach has also had wider implications for the nascent Sui ecosystem, raising concerns about the security of DeFi protocols on newer chains and the speed at which they are able to respond to critical vulnerabilities.

違規行為還對新生的SUI生態系統產生了更廣泛的影響，引起了人們對Fefi協議對新鏈的安全性以及他們能夠對關鍵漏洞做出響應的速度的擔憂。

Liquidity providers on Sui rapidly withdrew their funds, exacerbating price slippage and destabilising token markets. Cross-chain bridges involving Sui assets also came under increased scrutiny as some services paused transactions to prevent potential contagion from the Cetus exploit.

SUI的流動性提供商迅速撤回了資金，加劇了價格滑倒和不穩定的令牌市場。涉及SUI資產的跨鏈橋樑也受到了越來越多的審查，因為某些服務停止了交易，以防止CETUS漏洞的潛在傳染。

In response to the crisis, Cetus Protocol has announced the complete suspension of all smart contracts and the launch of an internal investigation in collaboration with the Sui Foundation and other key stakeholders. The team is actively pursuing options for recovering the stolen funds.

為了應對危機，CETUS協議宣布了與SUI基金會和其他主要利益相關者合作的所有智能合約的完全暫停和內部調查。該團隊正在積極尋求恢復被盜資金的選擇。

According to reports by several blockchain analytics firms, the primary address involved in the exploit is 0xe28b50. This wallet is currently known to hold 12.9 million SUI tokens, valued at $54 million. A portion of the stolen funds has already been liquidated into other assets.

根據幾家區塊鏈分析公司的報導，利用中涉及的主要地址為0xE28B50。目前，該錢包持有1,290萬個Sui代幣，價值5400萬美元。一部分被盜資金已經被清算到其他資產中。

Cetus has also extended a $6 million bounty to the hacker, offering immunity from legal action if the stolen coins are returned. This white-hat recovery approach, though controversial, reflects the urgency and magnitude of the loss.

Cetus還向黑客延長了600萬美元的賞金，如果返回被盜硬幣，則可以免於法律行動。這種白帽恢復方法雖然有爭議，但反映了損失的緊迫性和幅度。

Going forward, Cetus will be undergoing a complete security audit and overhaul of its codebase. Its developers will be working to patch the vulnerabilities that were exploited in the attack, and third-party firms will be brought in to conduct independent reviews of the protocol’s smart contracts.

展望未來，Cetus將對其代碼庫進行完整的安全審核和大修。其開發人員將努力修補攻擊中利用的漏洞，並將引入第三方公司以對協議的智能合約進行獨立的審查。

This incident is likely to spark broader reforms in how DeFi protocols approach oracle security, token whitelisting procedures, and smart contract validation.

這一事件可能會引發更廣泛的改革，即Fefi協議如何接近Oracle安全性，doken白名單程序和智能合同驗證。

The Sui Foundation is also expected to introduce new standards and guidelines for the purpose of preventing

還期望SUI基金會引入新的標準和準則，以防止