|
Getting your Trinity Audio player ready...
|
May 22, 2025 — A critical vulnerability in Cetus Protocol, a decentralized liquidity provider on the SUI blockchain, has led to the theft of approximately $223 million in digital assets, making it the second-largest crypto heist of the year, according to reporting by SecurityWeek’s Ionut Arghire.
The exploit targeted a flaw in the liquidity pool smart contract, allowing attackers to manipulate pool prices and repeatedly drain token reserves, Cetus confirmed in a post-mortem report. The vulnerability stemmed from an open-source library used in its protocol.
“By manipulating the pool’s tick and liquidity mechanisms, the attacker successfully drained a significant portion of assets across multiple iterations of the exploit,” Cetus said.
Sophisticated Cross-Chain Movement of Funds
The attack involved a complex series of token swaps and blockchain bridges. The perpetrators initially swapped USDT for USDC—two leading stablecoins issued by Tether and Circle—before bridging assets to the Ethereum network, where they converted the funds into ETH, according to blockchain analytics firm Elliptic.
Cetus has since identified two SUI wallet addresses linked to the hackers and tracked two Ethereum wallets now holding portions of the stolen assets. Of the $223 million taken, $162 million has been frozen, Cetus said, adding that recovery efforts are ongoing in collaboration with the Sui Foundation and other ecosystem partners.
Response and Whitehat Offer
In a bid to recover the stolen assets, Cetus has issued a “whitehat” bounty offer, proposing that the hackers return the majority of the funds in exchange for keeping $6 million as a reward.
The company also announced that it is working on a liquidity recovery plan, with reimbursement and withdrawal functionality as top priorities. As part of this effort, a critical loan from the Sui Foundation has been secured.
“Using our cash and token treasuries, we are now in a position to fully cover the stolen assets currently off-chain if the locked funds are recovered through the upcoming community vote,” Cetus stated on X. “This includes a critical loan from the Sui Foundation, making a 100% recovery for all affected users possible.”
Second-Largest Crypto Heist of 2025
This breach follows the $1.5 billion Bybit hack, placing the Cetus incident as the second most severe cryptocurrency security event of the year so far.
Cetus has paused all affected contracts and is actively working with blockchain forensics teams to trace remaining funds and implement further security controls to prevent recurrence.
Let me know if you’d like a shorter version for social media or newsletter distribution.
