SUI链的CETUS协议被黑客入侵，从LP池中排出超过2.6亿美元

5月22日下午，SUI链上领先的DEX流动性协议CETUS协议的CETU突然急剧下降

On Monday, May 22, the token of leading DEX liquidity protocol Cetus Protocol on Sui Chain saw its price almost drop to zero. Afterward, multiple token trading pairs on Cetus experienced a sharp decline.

5月22日，星期一，SUI连锁店领先的DEX流动性协议CETUS协议的代币几乎下降到零。之后，Cetus上的多个代币交易对经历了急剧下降。

Later in the evening, several KOLs posted on X that the Cetus protocol LP pool was attacked by hackers. According to on-chain monitoring, the Cetus attacker appears to have controlled all LP pools denominated in SUI. As of press time, the amount of theft has exceeded $260 million.

傍晚，在X上发布了几个KOLS，称CETUS协议LP池受到黑客攻击。根据链链监测，CETUS攻击者似乎控制了SUI中被计数的所有LP池。截至发稿时，盗窃金额已超过2.6亿美元。

Currently, the hacker has begun converting funds into USDC and cross-chain to the Ethereum mainnet to exchange for ETH. About 60 million USDC has completed cross-chain transfers. The hacker's on-chain address is: 0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06.

目前，黑客已经开始将资金转换为USDC，并将交叉链转换为以太坊主网以换取ETH。约6000万美元已完成跨链转移。黑客的链链地址是：0xE28B50CEF1D633EA43D3296A3F6B67FF0312A5F1A99F1A99F0AF753C85B8B8B5DE8FF06。

Mainstream Sui ecological tokens such as CETUS, WAL, and DEEP are also included, which shows that the scope of this hacker attack is extremely wide.

还包括主流Sui生态令牌，例如Cetus，Wal和Deep，这表明这种黑客攻击的范围非常广泛。

On the evening of the 22nd, a member of the Cetus team said in the project Discord group chat that the Cetus protocol was not stolen, but a "oracle bug" appeared. But the on-chain data does not lie. According to statistics, the loss of the Cetus protocol LP pool exceeded US$260 million within 1 hour after the theft, exceeding the protocol TVL (US$240 million) and market value (US$180 million).

在22日晚上，Cetus团队的一名成员在项目Discord Group聊天中说，CETUS协议没有被盗，但出现了“ Oracle Bug”。但是链上的数据并不存在。根据统计数据，CETUS协议LP池的损失在盗窃后1小时内超过了2.6亿美元，超过了TVL协议（2.4亿美元）和市值（1.8亿美元）。

On the morning of the 23rd, Cetus officially released the latest progress of the theft on social media, saying that the team has found the root cause of the vulnerability and fixed the relevant software packages, and hired a professional anti-cybercrime organization to support our fund tracking and negotiations on the safe return of funds. We are currently negotiating with law enforcement agencies and arranging further assistance.

23日上午，Cetus正式发布了社交媒体上盗窃的最新进展，称该团队找到了脆弱性的根本原因并修复了相关的软件包，并聘请了一个专业的反过程组织，以支持我们的资金跟踪和谈判，并在资金的安全返回方面进行谈判。我们目前正在与执法机构进行谈判，并安排进一步的帮助。

It is worth noting that the official said that it has confirmed the Ethereum wallet address controlled by the hacker in the earlier attack today, and has negotiated with him on the return of customer funds. It has been proposed to pay the outstanding balance in the name of the white hat hacker, but the time is limited. If the hacker accepts the terms, no further legal action will be taken.

值得注意的是，这位官员说，它已经确认了黑客在今天的较早袭击中控制的以太坊钱包地址，并在客户资金返回后与他进行了谈判。有人建议以白帽黑客的名义支付未偿还的余额，但时间有限。如果黑客接受该条款，则不会采取进一步的法律诉讼。

Community opinion points out that the team has a history of theft

社区意见指出，团队有盗窃的历史

Interestingly, when Cetus caused the SUI ecosystem to plummet, many community members also pointed out on Twitter that Cetus and the previous Solana ecosystem DeFi protocol Crema Finance were developed by the same team, and Crema had suffered a theft incident.

有趣的是，当Cetus导致SUI生态系统暴跌时，许多社区成员还在Twitter上指出，Cetus和先前的Solana Ecosystem Defi Protocal Crema Crema Finance是由同一团队开发的，Crema遭受了盗窃事件。

On July 3, 2022, Crema Finance was also attacked by hackers using Solend flash loans, and the LP fund pool was drained, with a loss of more than $8 million. Then on July 7, the hacker returned $7.6 million worth of stolen cryptocurrency after negotiation with the team. According to the negotiation agreement between the two parties, the hacker was allowed to keep 45,455 SOL ($1.65 million) as a bounty.

2022年7月3日，Crema Finance也遭到黑客使用Solend Flash贷款的攻击，LP Fund Pool耗尽了，损失了超过800万美元。然后在7月7日，黑客与团队谈判后返回了价值760万美元的被盗加密货币。根据双方之间的谈判协议，黑客被允许将45,455 SOL（165万美元）保留为赏金。

Looking back at the Cetus theft, the protocol also suffered losses because the attacker controlled the LP pool, and the team also proposed to negotiate with the hacker by paying the outstanding balance in the name of the white hat hacker. There is currently no public information to prove that Crema and Cetus were indeed developed by the same team, but at present, both are indeed consistent in terms of the cause of the theft and the subsequent handling method.

回顾CETUS盗窃案，该协议也遭受了损失，因为攻击者控制了LP池，并且该团队还建议以White Hat Hacker的名义支付未偿余额，以与黑客进行谈判。目前尚无公共信息可以证明Crema和Cetus确实是由同一团队开发的，但是目前，两者在盗窃案和随后的处理方法方面确实是一致的。

Sui officials freeze hacker transactions, "on-chain censorship" raises questions about centralization

SUI官员冻结黑客交易，“链审查”提出了有关集中化的问题

According to DeFiLlama data, Cetus has been the leading DEX and liquidity gathering place in the Sui ecosystem, accounting for more than 60% of the transaction volume of the entire ecosystem. This "clearance-style" attack undoubtedly directly destroyed the liquidity center of the ecosystem. For any "second-tier public chain", this is a devastating blow.

根据Defillama数据，CETU是SUI生态系统中领先的DEX和流动性收集地，占整个生态系统交易量的60％以上。这种“清除式”攻击无疑直接摧毁了生态系统的流动性中心。对于任何“二线公共连锁店”，这都是毁灭性的打击。

Since March last year, the transaction volume on the Sui ecosystem chain has been on an overall upward trend, and the prices of mainstream ecosystem tokens such as CETUS, DEEP, and WAL have also been soaring. It is generally regarded by the community as the public chain with the greatest return potential in this cycle and the "next Solana."

自去年3月以来，SUI生态系统连锁店的交易量一直处于总体上升趋势，而主流生态系统令牌（例如Cetus，Deep和Wal）的价格也在飙升。它通常被社区视为在本周期中具有最大回报潜力的公共连锁店和“下一个Solana”。

However, what’s interesting is that according to Dune data, there have always been a large number of wash trades on the Sui chain, and the ecological liquidity toxicity has been close to 50% for a long time. This is also part of the reason why the community has reported that the Sui ecosystem "has nothing, but the price keeps rising."

但是，有趣的是，根据沙丘数据，SUI链上总是有大量的WASH交易，并且长期以来，生态流动性毒性接近50％。这也是社区报告说Sui生态系统“什么都没有，但价格不断上涨”的部分原因。

Caption: The radius of the circle in the figure below shows the total transaction volume of a single address

标题：下图中圆的半径显示了单个地址的总交易量