Cetus Protocol (2025) — Crypto Hack
Partially RecoveredAn attacker sent spoof tokens to trick the Sui-based Cetus DEX into overvaluing them, skewing price data and draining ~$220M in liquidity.
Summary
An attacker sent spoof tokens to trick the Sui-based Cetus DEX into overvaluing them, skewing price data and draining ~$220M in liquidity.
How It Was Compromised — Smart Contract Exploit via Spoof tokens with no market value tricked DEX price logic into draining liquidity pools
On May 22, 2025, Cetus Protocol, a DEX on Sui, was exploited when an attacker sent spoof tokens with no market value that the protocol treated as valuable. This skewed price data and enabled the attacker to drain liquidity pools for approximately $220M. Sui validators froze ~$160M, while the attacker extracted over $60M to Ethereum.
Fund Flow & Laundering Analysis
~$160M frozen by Sui validators and returned. Attacker extracted >$60M to Ethereum via cross-chain bridges; that portion remains unrecovered.