Suspected Cetus Hack Drains $200 Million from DEX on Sui

• Cetus DEX pauses after possible attack on Sui blockchain
• Over $200 million drained from liquidity pools
• Cetus tokens drop up to 80% after incident

Cetus, a leading decentralized exchange on the Sui blockchain, is at the center of a crisis on Thursday after suspicious transactions led to the draining of more than $200 million in liquidity from its pools. On-chain data points to a possible exploit that forced the suspension of the platform, directly affecting the network’s DeFi ecosystem.

Users reported trading failures for several token pairs and observed sharp drops in the value of assets linked to Cetus. In some cases, tokens fell by up to 80% in value. Despite this, the network's native token, $SUI, remained stable on centralized exchanges.

🚨Alert Announcement 🚨

There was an incident detected on our protocol and our smart contract has been paused temporarily for safety. The team is investigating the incident at the moment. A further investigation statement will be made soon. We are grateful for your patience.

— Cetus🐳 (@CetusProtocol) May 22, 2025

Shortly after the incident, the protocol team stated that they had paused the DEX smart contract as a preventive measure. According to the statement, an anomaly was detected and, given the severity of the atypical behavior, operations were immediately halted to prevent further losses. The team stressed that an investigation is already underway.

The foundation behind the Sui blockchain confirmed that it is working in partnership with the Cetus team to understand the extent of the incident and promised updates as new data is revealed.

The sharp drop in liquidity raises concerns about the security of smart contracts operating in the Sui ecosystem. The episode also reignites the debate about the technical risks associated with DeFi platforms, especially those that concentrate large amounts of capital in still-maturing environments.

While the analysis of the contracts continues, the Sui community remains attentive to developments, awaiting clarification on the origin and possible authorship of the attack, as well as mitigation measures for affected users.