Sui shares details on $220M Cetus exploit, vows to step up security

Multiple rounds of prior audits did not catch the flaw, the DEX said

article-image

Patme Design/Shutterstock and Adobe modified by Blockworks

share

This is a segment from The Drop newsletter. To read full editions, subscribe.


We now know more about the bug that was exploited last week, resulting in over $220 million in frozen and stolen funds from the Sui-based DEX Cetus.

On Monday, Sui described the flaw as “a bug in a Cetus math library” and promised to commit $10 million to improving Sui’s security more broadly. That includes a bug bounty program, plus Sui-funded security audits for projects using the chain.

Blockchain security firm Dedaub explained that the attack involved intentionally misconfiguring a liquidity pool with an “extremely high value.”

“This allowed them to add massive liquidity positions with just 1 unit of token input, subsequently draining pools collectively containing hundreds of millions of dollars worth of token,” the firm wrote.

Image from Cetus detailing how the incident occurred.

As of May 26, Cetus said that the majority of the swiped crypto (roughly $162 million) remained frozen across two Sui wallets, while the rest of the stolen funds had already been converted to ETH by the attacker. 

“Cetus has been among the DeFi teams on Sui that invested the most in smart contract audits and system safeguards. Unfortunately, reality does not always unfold as we wish,” Cetus said in its disclosure. “Multiple rounds of audits on the underlying contracts and the dependent open-source libraries — combined with their widespread and successful use by ecosystem developers — gave us a sense that we had done enough. In hindsight, we realize we allowed ourselves to relax our vigilance. This painful lesson has shown us: we must do more.”

The DEX further said last week it hasn’t heard from the hacker thus far.

Sui isn’t the only one that’s recently seen crypto swiped on its chain due to an exploit. On a much smaller scale, Cardex, a game on Abstract, had a flaw that resulted in at least $500,000 being siphoned from that app’s users earlier this year.

Being permissionless means more people can build in a chain’s ecosystem with less oversight, getting closer to financial decentralization, one of the original aims of crypto. 

But it also means a chain’s reputation can take a hit when some apps that use it are lacking on the security front — leading to headline-generating exploits and losses often in the millions.

“Security audits are inherently imperfect,” wrote BlockSec’s CCO, who goes by Orlando on X, in response to the incident. “In 2023, the entire crypto market spent $1 billion on security audits, yet $2 billion in assets were still stolen.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template.png

Research

Institutional staking providers specialize in offering secure, compliant, and scalable solutions for organizations, asset managers, and individuals who wish to stake large volumes of digital assets. Staking-as-a-Service Providers (SaaSPs) act as intermediaries, running blockchain nodes and managing the technical complexities of staking on behalf of clients, often providing custody, reporting, and yield optimization features across a broad range of assets and networks.

article-image

Share indexes every transaction across Solana, Base and Ethereum

article-image

The plan is to scale PayPal USD with Spark’s liquidity framework, building sustainable stablecoin markets

by Blockworks /
article-image

The company introduced a dollar-backed stablecoin to power instant payments and microtransactions for AI-driven web platforms

by Blockworks /
article-image

The plan is to make GameShift the “consumer portal” that bridges non-crypto gamers into Web3

article-image

Google backs $1.4B of obligations and takes 5.4% stake as Cipher expands AI data center footprint

by Blockworks /
article-image

Nine banks plan MiCA-regulated token to challenge dollar dominance and strengthen Europe’s payments autonomy

by Blockworks /