David Edwards
Cetus, a decentralized exchange operating on the Sui blockchain, is at the center of a suspected exploit that may have resulted in the loss of over $200 million in digital assets. On-chain data and cybersecurity experts suggest that the breach, which began unfolding on May 22, could be one of the most severe security incidents to hit a Sui-based platform.
The alarm was initially raised by pseudonymous Web3 researcher COMDARE3, who reported signs of a major exploit affecting Cetus. Market data from DEX Screener corroborated these claims, showing massive devaluations across multiple assets, some losing over 75% of their value within 24 hours.
Further investigation by Hacken’s Extractor tool revealed that at least $63 million had already been bridged to Ethereum. In a single transaction, 20,000 ETH was moved to a newly created wallet. Hacken researcher Yehor Rudytsia confirmed these findings, lending credence to fears of a coordinated exploit.
Data from Cetus shows that transaction volume surged to $2.9 billion on May 22, compared to just $320 million the day before—suggesting a potential siphoning of funds. While the Cetus team has not issued a formal statement, its official X profile acknowledged the detection of an “incident” and confirmed that smart contracts have been paused pending investigation.
The incident is already having ripple effects across the Sui ecosystem. Scallop, a money market platform built on Sui, has suspended all borrowing operations and promised further updates once its internal review is complete. While some tokens like LBTC have shown signs of recovery, others, such as Axol (AXOL), have plunged by as much as 99.5%.
Blockchain analytics firm AMLBot noted the speed and scale of the fund transfers. According to their analysis, $212 million was bridged to Ethereum at a rate of approximately $1 million per minute. The firm questioned the Cetus team’s characterization of the event as “just a bug,” pointing to the timing and magnitude of the transfers as signs of a possible deeper issue.
Onchain Lens, another blockchain intelligence service, reported that the alleged attacker gained control over all SUI-denominated pools and has begun moving large volumes of USDC. The exploiter’s address currently holds nearly $52 million in SUI, $4.9 million in Haedal Staked SUI (HASUI), $19.5 million in Toilet (TOILET), and $19.5 million in wrapped USDT, among other assets.
The full scope of the breach remains under investigation, but early signs indicate a highly organized and potentially devastating exploit that could have long-lasting implications for both Cetus and the broader Sui ecosystem.
