Cetus Protocol has ‘paused’ 73% of funds stolen by hackers

Cetus Protocol, the top automated market maker (AMM) DEX on the Sui network, suffered a major security breach in which attackers accessed its liquidity pools and caused a loss exceeding $220 million.

On May 22, 2025, multiple users reported that attackers exploited Cetus Protocol (CETUS)—an AMM DEX built with the Move programming language and running on both the Sui and Aptos blockchains—at the protocol level, resulting in a complete liquidity drain.

The attacker targeted the SUI/USDC liquidity pool on Cetus and withdrew about $11 million in SUI, according to blockchain investigators. This caused a sharp decline of more than 75% in the value of most tokens and wiped out the pool’s liquidity.

The investigators are currently investigating the incident.

Suiscan tracked wallet “0xe28b…e8ff06” and confirmed that the hacker withdrew liquidity from a number of Cetus pools and then swapped the tokens into SUI.

At present, the hacker controls digital assets estimated at $260 million, including 12.989 million SUI tokens (valued at about $54 million), and is actively moving them across chains to facilitate laundering.

Following the attack, the Cetus Protocol team officially confirmed the exploit and suspended smart contracts as a precautionary measure to secure the network.

The chief technology officer at HackenProof speculated that attackers used several coordinated actions: they swapped fraudulent tokens like BULLA for SUI by abusing pricing flaws, contributed almost zero liquidity to skew the pool’s state or create illegitimate pairs, and executed multiple liquidity removals that introduced accounting mismatches—enabling them to siphon genuine SUI/USDC assets.

As of now, no one knows whether the breach in Cetus Protocol originated from a vulnerability affecting the entire system or if attackers specifically targeted a major Liquidity Provider’s position, triggering a cascading failure across the protocol.

Traders on the Sui network have seen tokens including WAL, DEEP, NAVX, LOFI, and HIPPO decrease in price by no less than 5% to 15% from their highest points before the hack.

With attackers draining the liquidity pools completely, numerous altcoins and memecoins have dropped in value by upwards of 80% since the hack, making trading impossible.

The attack most severely affected CETUS, which saw a dramatic price drop exceeding 16%, marked by a “dump god” candlestick. Before the attackers struck, CETUS traded at roughly $0.24, whereas now it hovers around $0.176.

Binance founder CZ vowed to do his utmost to help Sui bounce back from the damage caused by the incident.

Both Bluefin and Momentum, the prominent DEX platforms on Sui after Cetus, have temporarily ceased operations to prevent any potential future issues while the teams address the situation.

The Cetus team has confirmed a significant 73% of the stolen funds has been successfully paused, and they are working with the Sui Foundation and other ecosystem members on the next steps.

The team has stated they will provide a full incident report at a later date.