# Devastating Cetus Hack on Sui: $223M Crypto Lost

By [SpecialAgentK.eth](https://paragraph.com/@specialagentk) · 2025-05-23

---

**Introduction**
----------------

On May 22, 2025, the **Sui** blockchain **crypto** ecosystem experienced its most significant security incident when **Cetus** Protocol, the network's largest decentralized exchange and liquidity provider, fell victim to a sophisticated **hack** that resulted in the theft of approximately $223 million in digital assets. The attack, which exploited fundamental vulnerabilities in the protocol's smart contract architecture, sent shockwaves through the decentralized finance (DeFi) sector and raised critical questions about security practices and **decentralization** in modern **crypto** networks. While **Cetus** and **Sui** validators managed to freeze $162 million of the stolen funds through coordinated intervention, the incident highlighted the fragility of DeFi protocols and the controversial role of centralized responses in supposedly decentralized systems, furthering the **decentralization** debate.

**The Cetus Protocol Exploit: Anatomy of a $223 Million Crypto Hack**
---------------------------------------------------------------------

**Scale and Immediate Impact of the Cetus Hack on Sui.** The **hack** on **Cetus** Protocol represents the largest decentralized finance **hack**

the DeFi **crypto** ecosystem. **Cetus**, recognized as the biggest DEX aggregator on the **Sui** blockchain, processed $2.9 billion worth of transactions on May 22 alone, a dramatic increase from the previous day's $320 million, indicating the massive scale of the **hack** as funds were rapidly siphoned from the protocol. The immediate financial impact extended beyond the direct theft, with the total assets held by investors in the **Sui crypto** network plummeting by over $330 million on Thursday, demonstrating the cascading effects of such security breaches on entire blockchain ecosystems.

The **hack**'s scope became apparent as blockchain analysts tracked the attacker's movements across multiple networks. According to on-chain data, the threat actor successfully bridged approximately $63 million to the Ethereum network, with $60 million converted to USDC and subsequently exchanged for ETH. The attacker's primary wallet, identified as an address ending in "AF16," was used to launder 20,000 Ether valued at roughly $53 million, while another wallet address recognized as 0xe28b50 contained over 12 million **SUI** tokens worth approximately $54 million at current market rates.

### **Technical Methodology of the Cetus Crypto Hack**

The sophistication of the **Cetus hack** lay in manipulating the protocol's pricing mechanisms by injecting worthless tokens designed to appear valuable. The attacker exploited fundamental flaws in **Cetus**' smart contracts by sending spoof tokens lacking genuine market value. Yet, vulnerabilities in the protocol's validation systems allowed these tokens to be treated as legitimate assets. This technique enabled the attacker to manipulate price data within **Cetus** and systematically drain the protocol's liquidity pools, effectively trading worthless assets for valuable **crypto**currencies like **SUI** and USDC.

Manan Vora, director at **crypto** custody company Liminal, aptly described the attack mechanism: "Imagine going to a toy exchange, you bring fake toys that look valuable but are worthless, then you trade them for real toys and run". The attacker specifically leveraged fake tokens such as BULLA and MOJO to exploit flawed price curves and reserve calculations within the protocol. By introducing minimal liquidity into targeted pools, the threat actor could distort the internal liquidity provider state and repeatedly withdraw valuable assets without making substantial deposits of real value.

Alex Horlan, CTO of web3 security firm HackenProof, identified the core vulnerability as likely residing in the mathematical calculations behind the protocol's addLiquidity, removeLiquidity, and swap functions, particularly in how these functions compute token ratios, round small values, and handle tokens with zero decimal places. This technical analysis suggests that the **hack** targeted fundamental algorithmic weaknesses in the automated market maker's price discovery mechanism, allowing for systematic value extraction through carefully crafted transactions.

### **Market Consequences and Sui Crypto Ecosystem Disruption from the Cetus Hack**

**Token Price Volatility and Market Panic Post-Hack** The immediate aftermath of the **Cetus hack** triggered severe price volatility across the **Sui crypto** ecosystem, with numerous tokens experiencing catastrophic losses that reflected widespread panic among investors. The **Cetus** Protocol's native token CETUS plummeted by approximately 40% within hours of the announcement, dropping from $0.25 to $0.155, while the broader **Sui** token declined by 4% to trade at $3.89. The selling pressure extended beyond directly affected tokens, with **Sui**\-based assets including Lofi crashing 76% and Hippo slumping 81%, demonstrating how security breaches like this **hack** can trigger contagion effects throughout interconnected DeFi ecosystems.

The market disruption was particularly severe for meme coins and smaller tokens within the **Sui crypto** ecosystem, with some assets experiencing losses exceeding 90%. USDC stablecoin on **Sui** temporarily depegged to zero following the attack, highlighting how exploits can undermine confidence in fundamental **crypto** infrastructure components that other protocols rely upon. The broader **crypto**currency market also felt the impact, with traders expressing concerns about cross-chain vulnerability risks and increased volatility in **SUI**, USDC, and ETH markets as large asset movements triggered potential arbitrage opportunities.

Data from DeFiLlama confirmed the dramatic scale of value destruction, showing **Cetus** Protocol's total value locked (TVL) falling by more than $200 million to approximately $75 million, representing an 84% drop in a single day. This metric underscores how quickly confidence can evaporate in decentralized finance, where the absence of traditional safety nets means that technical vulnerabilities can translate directly into massive financial losses for users and liquidity providers in the **crypto** space.

### **Broader Implications of the Cetus Hack for Sui's DeFi Ecosystem and Decentralization.**

The **Cetus hack** has fundamentally altered the trajectory of **Sui**'s recent growth momentum, potentially derailing an intense recovery period for the blockchain network. Before the **hack**, **Sui** had sustained gains exceeding 60% over the past 60 days, reflecting positive sentiment in the broader **crypto**currency market and confidence in the network's technical capabilities. The token had reached highs around $4.29 on May 12 following a steady recovery from an April crash. Still, this major security incident has introduced significant uncertainty about the **Sui crypto** network's near-term prospects.

Technical analysis suggests that **Sui**'s price action now faces critical resistance levels, with key monitoring points including the 50-day Exponential Moving Average at $3.34, the 100-day EMA near $3.17, and the 200-day EMA at $2.99. The Moving Average Convergence Divergence (MACD) indicator has generated a sell signal as the MACD line crossed below the signal line, while expanding red histogram bars beneath the center line affirm the bearish momentum. However, the Relative Strength Index (RSI) remains at 62, suggesting that the underlying uptrend may still have strength and could potentially resume if confidence in **Sui**'s **crypto** security is restored.

The incident has also raised fundamental questions about the maturity and security practices of the **Sui** ecosystem's DeFi infrastructure, especially concerning **decentralization**. With **Cetus** serving as the primary liquidity provider and DEX aggregator for the network, its compromise has created significant operational challenges for other protocols that depend on its services. The cascading effects have demonstrated how the interconnected nature of DeFi can amplify the impact of individual protocol failures like this **hack**, potentially requiring months or years for the ecosystem to recover from the reputational and financial damage fully.

### **Response Coordination and Recovery Efforts After the Cetus Hack on Sui**

**Immediate Crisis Management Post-Hack** The response to the **Cetus hack** demonstrated both the advantages and controversies of coordinated intervention in decentralized systems, impacting the **decentralization** narrative. **Cetus** acted swiftly upon detecting the attack, immediately pausing its smart contracts and suspending trading operations to prevent further fund drainage. This rapid response capability proved crucial in limiting the scope of the damage from the **hack**, as the protocol was able to halt additional losses and begin implementing protective measures within hours of the exploit's discovery.

The **Sui** Foundation was central in coordinating the ecosystem-wide response to the **Cetus crypto hack**, working closely with validators to implement emergency measures. According to official statements, "Many validators identified the addresses with the stolen funds and are ignoring transactions on those addresses until further notice". This coordinated validator action effectively froze approximately $162 million of the compromised assets, representing roughly 72% of the total stolen amount from the **hack**. The **Sui** Foundation emphasized that this intervention was part of a collaborative effort involving multiple ecosystem participants working toward the goal of fund recovery from this significant **crypto hack**.

**Cetus** confirmed its cooperation with various stakeholders in the recovery process, stating: "We are working with the **Sui** Foundation and other ecosystem members right now on next-step solutions to recover the remaining stolen funds from the **hack**". The protocol also committed to providing a comprehensive incident report detailing the technical aspects of the **hack** and the measures being implemented to prevent similar attacks in the future. This transparency initiative aims to rebuild confidence among **crypto** users and demonstrate the protocol's commitment to security improvements.

### **Industry Support and Collaborative Efforts in the Wake of the Sui Crypto Hack.**

The **Cetus hack** attracted attention and support from prominent cryptocurrency industry figures, highlighting the blockchain ecosystem's interconnected nature. Binance founder Changpeng Zhao publicly announced that his exchange's team had contacted **Sui** to offer assistance in resolving the situation, demonstrating how major **crypto** industry players often coordinate during significant security incidents like this **hack**. This type of cross-institutional cooperation has become increasingly common in the **crypto** space, where shared interests in maintaining ecosystem stability often override competitive considerations.

The response also involved specialized security firms and blockchain analytics companies that contributed technical expertise to the investigation and recovery efforts from the **Cetus hack**. Hacken's Web3 researcher Yehor Rudytsia confirmed fund movements and tracking capabilities that helped establish the scope of the **hack**. Similarly, blockchain analytics firm Lookonchain played a crucial role in monitoring the attacker's activities across multiple networks, providing real-time updates on fund movements and conversion activities related to the **crypto** assets.

However, the coordinated response has also generated significant debate within the **crypto** community regarding the implications for **decentralization** and censorship resistance on the **Sui** network. The ability of validators to collectively ignore transactions from specific addresses raises fundamental questions about the permissionless nature of blockchain networks and the potential for coordinated censorship in crisis situations following a **hack**.

### **Centralization Concerns and Governance Questions Arising from the Sui Cetus Hack**

**Debate Over Validator Intervention: Security vs. Decentralization on Sui.** The coordinated validator response to freeze stolen funds from the **Cetus hack** has sparked intense debate within the **crypto** community about the balance between security and **decentralization** principles. Critics have pointed to the validators' ability to collectively ignore transactions from specific addresses as evidence of concerning centralization within the **Sui** network. One community member noted: "What's worse? A **hacker** stealing funds, or validators freezing wallets," highlighting the philosophical tension between protecting users and maintaining network neutrality and true **decentralization**.

The controversy extends beyond the immediate **Cetus hack** to broader questions about the nature of **decentralization** in modern **crypto** blockchain networks like **Sui**. With only 114 validators in total on the **Sui** network, the relatively small number of entities required to coordinate such interventions has raised concerns about the network's censorship resistance and true **decentralization**. Critics argue that if validators can freeze wallets at will during crises such as this **hack**, it fundamentally undermines the permissionless and trustless properties that distinguish **crypto** networks from traditional financial systems, challenging the core tenets of **decentralization**.

Supporters of the intervention argue that the coordinated response following the **Cetus hack** was necessary to protect users and prevent further damage to the **Sui crypto** ecosystem. They contend that the validators' actions represent a form of emergency governance that demonstrates the network's ability to respond effectively to existential threats. This perspective views the intervention as a necessary evolution of blockchain governance that balances ideological purity of **decentralization** with practical user protection in the face of a major **crypto hack**.

### **Smart Contract Pause Capabilities: A Challenge to Cetus's Decentralization?**

The ability of **Cetus** to unilaterally pause its smart contracts has generated additional criticism regarding the protocol's **decentralization** claims, especially highlighted by this **hack**. In traditional DeFi theory, no single party should have the authority to halt contract execution, as this capability introduces central points of failure and control that contradict the fundamental principles of decentralized finance and **crypto**. The pause mechanism, while effective in limiting damage during the **Cetus hack**, has raised questions about whether protocols with such capabilities can legitimately claim to be champions of **decentralization**.

The debate over pause capabilities reflects broader tensions within the DeFi **crypto** space between security and the ideology of **decentralization**. Proponents argue that emergency pause functions are essential safety mechanisms that allow protocols to respond to critical vulnerabilities, like those exploited in the **Cetus hack**, before they can be fully exploited. They point to the **Cetus** incident as evidence that such mechanisms can be crucial in protecting user funds and maintaining **crypto** ecosystem stability during crisis situations.

However, critics contend that the existence of pause capabilities fundamentally alters the risk profile and trust assumptions of DeFi protocols, impacting **decentralization**. Users who deposit **crypto** funds into protocols with pause mechanisms must trust that these powers will not be abused, effectively reintroducing counterparty risk that decentralized systems are designed to eliminate. This tension highlights ongoing challenges in the DeFi space regarding how to balance security, usability, and genuine **decentralization** after a significant **hack**.

**Technical Analysis and Security Implications of the Cetus Crypto Hack on Sui**
--------------------------------------------------------------------------------

### **Oracle Manipulation and Price Discovery Vulnerabilities in the Cetus Hack.**

The **Cetus hack** appears to have specifically targeted vulnerabilities in the protocol's oracle system and price discovery mechanisms, highlighting broader challenges facing decentralized exchanges in maintaining accurate pricing data for **crypto** assets. Early analysis suggested that the incident may have been linked to flaws in the protocol's pricing mechanism, with a **Cetus** team member initially describing the situation as "not **hacked**, we've detected a bug in the oracle". This characterization points to fundamental challenges in implementing reliable price feeds within automated market maker systems, a critical aspect of **crypto** trading on **Sui**.

**Cetus** employs a dual approach to oracle functionality, utilizing both internal oracles via concentrated liquidity pools and integration with the Pyth Network for external price data. The internal oracle system allows the protocol's concentrated liquidity pools to serve as on-chain price discovery mechanisms, providing real-time liquidity data and historical price information derived directly from actual trading activities on the **Sui** network. This approach reduces reliance on off-chain data sources and minimizes risks associated with traditional oracle manipulation attacks common in **crypto hacks**.

However, the **Cetus hack** demonstrated that even sophisticated oracle systems remain vulnerable to manipulation when fundamental smart contract logic contains flaws. The attacker's ability to inject near-zero liquidity and manipulate internal pool states suggests that the mathematical foundations of the price calculation mechanisms contained exploitable weaknesses. This vulnerability is hazardous in the crypto world because it allows attackers to extract value systematically while maintaining the appearance of legitimate trading activity until the **hack** is discovered.

The incident also raises questions about the broader reliability of on-chain oracle systems in DeFi protocols like those on **Sui**. While **Cetus**'s approach of using actual trading data to determine **crypto** prices is theoretically more robust than off-chain oracles, the **hack** demonstrated that flawed implementation can still create significant vulnerabilities. The fact that the attack was able to manipulate price curves and reserve calculations suggests that fundamental assumptions about the relationship between liquidity provision and price discovery may need to be reconsidered in future protocol designs to prevent similar **crypto hacks**.

### **Lessons for Smart Contract Security from the Cetus Hack.**

The **Cetus hack** provides valuable insights into the ongoing challenges of smart contract security in the rapidly evolving DeFi and **crypto** landscape. The **hack**'s success in manipulating fundamental protocol mechanics through the injection of worthless tokens highlights the critical importance of comprehensive input validation and edge case testing in smart contract development. The fact that fake tokens could be used to distort price calculations suggests that the protocol's validation mechanisms were insufficient to distinguish between legitimate and malicious assets, a key failure leading to this **crypto hack** on **Sui**.

The incident underscores the need for more rigorous mathematical verification of automated market maker algorithms, particularly in how they handle token ratios, decimal precision, and edge cases involving tokens with unusual characteristics which can be exploited in a **hack**. The attacker's ability to exploit rounding errors and decimal handling issues demonstrates that even seemingly minor implementation details can create significant vulnerabilities when subjected to adversarial testing, as seen in the **Cetus crypto hack**.

The **hack** also highlights the importance of fail-safe mechanisms and circuit breakers in DeFi protocols. While **Cetus**'s ability to pause operations proved crucial in limiting damage, the incident suggests that more sophisticated monitoring and automatic protection systems might be necessary to detect and respond to novel **hack** vectors in real-time. Future **crypto** protocol designs, especially on emerging platforms like **Sui**, may need to incorporate more sophisticated anomaly detection systems that can identify suspicious trading patterns before they can cause significant damage from a **hack**.

**Conclusion: The Cetus Hack's Impact on Sui, Crypto, and the Decentralization Dialogue**
-----------------------------------------------------------------------------------------

The **Cetus** Protocol **hack** represents a watershed moment for the **Sui crypto** ecosystem and the broader decentralized finance sector, demonstrating the persistent vulnerabilities plaguing DeFi protocols and the complex trade-offs between security, **decentralization**, and user protection. The $223 million **crypto** theft, while devastating for affected users and the protocol itself, has provided valuable lessons about smart contract security, oracle design, and crisis response in decentralized systems following a major **hack**. The incident's sophisticated exploitation of price discovery mechanisms through fake token injection reveals fundamental challenges in automated market maker design that extend far beyond any single protocol or blockchain network, impacting the entire **crypto** space.

The coordinated response involving **Cetus**, the **Sui** Foundation, and network validators successfully recovered approximately 72% of the stolen **crypto** funds, demonstrating the potential effectiveness of collaborative crisis management in blockchain ecosystems after a **hack**. However, this response has also sparked important debates about the nature of **decentralization** and the acceptable limits of coordinated intervention in supposedly permissionless systems like **Sui**. The ability to freeze wallets and pause smart contracts, while crucial for damage limitation from the **Cetus hack**, raises fundamental questions about whether such capabilities are compatible with the core principles of **decentralization** in **crypto**.

Looking forward, the **Cetus hack** on **Sui** will likely serve as a catalyst for enhanced security practices across the DeFi and **crypto** sector, particularly in the areas of oracle design, input validation, and mathematical verification of trading algorithms. The **hack**'s success in manipulating fundamental protocol mechanics suggests that the **crypto** industry must develop more sophisticated approaches to testing and validation that can identify edge cases and adversarial scenarios before they can be exploited. Additionally, the incident highlights the need for continued evolution in crisis response mechanisms that can balance the competing demands of user protection, **decentralization**, and network integrity in the **crypto** world. As the DeFi sector continues to mature, the lessons learned from this **Cetus hack** will undoubtedly influence the design and governance of future protocols on **Sui** and other networks, potentially leading to more robust and resilient decentralized financial infrastructure for all **crypto** users.

---

*Originally published on [SpecialAgentK.eth](https://paragraph.com/@specialagentk/devastating-cetus-hack-on-sui-223m-crypto-lost)*