An attacker sent spoof tokens to trick the Sui-based Cetus DEX into overvaluing them, skewing price data and draining ~$220M in liquidity.
On May 22, 2025, Cetus Protocol, a DEX on Sui, was exploited when an attacker sent spoof tokens with no market value that the protocol treated as valuable. This skewed price data and enabled the attacker to drain liquidity pools for approximately $220M. Sui validators froze ~$160M, while the attacker extracted over $60M to Ethereum.
~$160M frozen by Sui validators and returned. Attacker extracted >$60M to Ethereum via cross-chain bridges; that portion remains unrecovered.
N/A