Sui Ecosystem Rocked by $200M ‘Oracle Manipulation Attack’ on Its Largest DEX

Briefly

Attackers exploited vulnerabilities in Cetus Protocol’s sensible contracts utilizing spoof tokens to govern value calculations and drain liquidity swimming pools on Sui’s largest decentralized trade.
Common Sui tokens together with Lofi, Sudeng, and Squirtle plummeted 76-97% inside an hour, whereas the Cetus token itself dropped 53% as 46 Sui tokens posted double-digit losses.
The attacker has $164 million in a Sui pockets and already bridged $61.5 million in USDC to Ethereum, with Cetus pausing contracts and investigations ongoing whereas Sui’s native token surprisingly rose 2.2%.

The Sui ecosystem has been rocked to its core by an exploit on the community’s largest decentralized exchange Cetus which has seen $200 million stolen from liquidity swimming pools.

Notable Sui meme cash like Lofi (LOFI), Sudeng (HIPPO), and Squirtle (SQUIRT) tanked 76%, 80%, and 97% in simply an hour. And the favored Cetus token dropped 53% over the identical timeframe. In accordance with DEX Screener, 46 Sui tokens have made double digit losses over the previous 24 hours.

“The attacker exploited vulnerabilities in Cetus Protocol’s sensible contracts by deploying spoof tokens to govern value curves and reserve calculations,” Deddy Lavid, CEO and co-founder of safety agency Cyvers, advised Decrypt. “This allowed them to extract actual property from a number of liquidity swimming pools, together with the SUI/USDC pool. The stolen funds are being transformed into USDC and bridged to different chains.”

PeckShield estimates that roughly $200 million price of property have been stolen attributable to this exploit. The attacker at the moment has $164 million sitting in a Sui wallet and has bridged $61.5 million price of USDC onto Ethereum.

A SUI spokesperson declined to touch upon the exploit when reached by Decrypt, as an alternative referring to what the crew had already shared publicly on X.

In response, Cetus paused its sensible contracts to stop any additional losses. The trade issued a statement on social media stating that an “incident” had been detected and that its crew was investigating it.

🚨Alert Announcement 🚨

There was an incident detected on our protocol and our sensible contract has been paused quickly for security. The crew is investigating the incident in the meanwhile. An additional investigation assertion will probably be made quickly. We’re grateful on your persistence.

— Cetus🐳 (@CetusProtocol) May 22, 2025

Leaked Discord messages suggest that the Cetus crew imagine the exploit got here because of a “bug” in its oracle. Customers on social media appeared skeptical of this, however Cyvers advised Decrypt the aforementioned exploit is named an “oracle manipulation assault.”

It’s because the attackers have been capable of manipulate the oracle to misrepresent the worth through the deployed spoof tokens.

The attacker has been transferring funds utilizing the USDC stablecoin. Circle has caught flak from business specialists, like on-chain sleuth ZachXBT, for its gradual response in freezing funds associated to hacks—taking greater than 5 hours to dam funds linked to the Bybit hack in February.

(And for what it’s price, USDT issuer Tether has had related complaints for its fund freeing process leaving a window for attackers to keep away from the punishment.)

“We’ve repeatedly urged stablecoin issuers to behave on our real-time alerts, but many nonetheless select to attend for autopsy investigations,” Lavid stated. “The sample is obvious: Motion comes days too late, if it comes in any respect. On this menace surroundings, delay is indistinguishable from inaction.”

This case continues to be creating with former Binance CEO Changpeng “CZ” Zhao claiming that his crew are doing what they will to assist Sui.

“Not a nice scenario,” he wrote on X, previously Twitter. “Hope everybody keep SAFU!”

Surprisingly, Sui’s value hasn’t been too badly affected by information of the exploit. The token has really risen 2.2% over the previous 24 hours, in line with CoinGecko.