Pierluigi Paganini
May 27, 2025
Last week, threat actors stole about $223 million from decentralized crypto exchange Cetus. The platform was paused during the investigation and later confirmed the cyber heist.
The company confirmed that it has successfully paused $162M and added that recovery efforts are underway with the Sui Foundation.
“As of earlier today, we have confirmed that an attacker has stolen approximately $223M from Cetus Protocol. We have took immediate action to lock our contract preventing further theft of funds. $162M of the compromised funds have been successfully paused.” the company wrote on X. “We are working with the Sui Foundation and other ecosystem members right now on next-step solutions, with the goal of recovering the remaining stolen funds.”
The crypto exchange said that it will provide a full incident report later.
Researchers at the blockchain security firm PeckShield confirmed the hack and said that the threat actors had already bridged the $60M to Ethereum.
Cetus Protocol discovered that the hack was due to a vulnerable package, which has now been fixed. They’ve identified the attacker’s Ethereum wallet and are working with partners and law enforcement to trace and freeze the funds. Cetus Protocol offered the hacker a limited-time deal: return the stolen funds and they’ll drop all legal action. They also put up a $5M bounty for tips that help identify and catch the attacker.
Researchers at Elliptic reported that the Cetus hack stemmed from a flaw in AMM logic, possibly involving price manipulation and flash loans. The attacker moved stolen funds across chains and swapped USDT to USDC. Elliptic is tracking the transactions and flagged the hacker’s wallet across major exchanges to block laundering efforts.
“Elliptic calculates that the combined value of the native $SUI token and other tokens stolen in this exploit exceed $200 million, making it the second largest hack of 2025 – behind the $1.46 billion hack of Bybit in February.” reads the report published by Elliptic. “A portion of the stolen funds are made up of tokens that have fallen substantially in value following the theft. Therefore, while some reports suggest that the stolen funds were worth in excess of $260 million just before the theft, the exploiter is unlikely to benefit from the full amount.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Cetus Protocol)
