Sui Network’s Largest DEX and Liquidity Provider Cetus Hacked for $260M

Cetus Protocol, the largest decentralized exchange on the Sui Network, suffered a major hack on Thursday, reportedly losing nine-figure funds.

The prominent Sui-based DEX lost over $260 million to the hack today, the leading on-chain analytical firm Lookonchain confirmed. The hacker gained access and drained Cetus’s liquidity pool, the report disclosed.

Meanwhile, Cetus confirmed it detected abnormal activity on its protocol and has paused its smart contracts for “safety.” While the tweet did not explicitly state the platform was exploited, the team assured users it was investigating the situation.

🚨Alert Announcement 🚨

There was an incident detected on our protocol and our smart contract has been paused temporarily for safety. The team is investigating the incident at the moment. A further investigation statement will be made soon. We are grateful for your patience.

— Cetus🐳 (@CetusProtocol) May 22, 2025

Remarkably, data from the Cetus pool shows a spike in transaction volume. It has processed $2.9 billion in the past 24 hours, compared to the $320 million recorded a day before, confirming the unusual activity on the Cetus Protocol.

Hacker Drains Liquidity

Further analysis of the exploit shows the hacker drained Cetus’ liquidity pool of millions in SUI and USDC. Notably, the protocol is the largest liquidity provider on the Sui blockchain.

Oleksander Horlan, the CTO of on-chain security firm HackenProof, further elaborated on the hack. He noted that the exploiter swapped on Cetus using spoof tokens like BULLA and leveraged the miscalculated or broken price curve.

Seems like all @CetusProtocol LP were drained

Looking into tx, the likely exploit path was:
1. Swap in spoof token (e.g. BULLA → SUI), taking advantage of miscalculated price curve or broken reserve math.

2. Add liquidity with a near-zero amount, to manipulate internal LP… pic.twitter.com/FtpYRSpwWW

— sashko🇺🇦 (@d0rsky) May 22, 2025

With the loophole, he manipulated the internal LP state and withdrew real assets like SUI and USDC while adding liquidity with a near-zero value. He also shared the address of the exploiter, which contained $75 million at the time of writing.

Lookonchain also confirmed that the hacker was moving the stolen funds to Ethereum, first converting them to USDC before bridging them to the smart contract network. The exploiter has already cross-chained $60 million USDC through this method.

Sui-based Tokens Crash

Meanwhile, many SUI-affiliated tokens have reacted adversely to the liquidity pool drain. BULLA crashed 60%, with other meme coins like SLOVE, Uni, and MEMEFI capitulating 93%, 77%, and 51%, respectively.

CETUS, the native token of the Cetus Protocol, also fell 34%, as tension among market investors surged. Nonetheless, SUI remains largely stable, correcting just 2.37% in the past 24 hours.

Crypto Community Rally Around SUI 

Amid the panic, major cryptocurrency players have rallied around the SUI ecosystem to show their support. For instance, Changpeng Zhao, Binance’s co-founder, confirmed in a tweet that the exchange is in contact with SUI and is doing its best to salvage the situation.

He also confirmed that multiple blockchain security entities are already working with SUI and Cetus to provide possible solutions. Furthermore, Bybit also released a statement on the hack, stating its willingness to support the Sui network or Cetus in any feasible capacity.