Cetus, a leading decentralized exchange on the Sui network, has published a detailed post-mortem report following a $223 million exploit that targeted its concentrated liquidity market maker pools on May 22.
In its May 26 incident report, Cetus explained that the attack was caused by a vulnerability in an open-source library used in its smart contracts. The hacker exploited a flaw in the platform’s liquidity management system, which controls how users add and remove tokens from trading pools.
The attacker used a feature called a flash swap, a kind of instant loan that lets users borrow tokens as long as they pay them back in the same transaction. Flash swaps were used to distort pool prices, add fake liquidity using only a small number of tokens, and then withdraw large amounts of real tokens over several rounds, draining multiple pools in the process.
Cetus explained that the root of the problem was an error in a third-party code library, where the system incorrectly checked for potential overflows, meaning it didn’t properly limit extremely large numbers.
“This issue has nothing to do with the MAX_U64 arithmetic bug flagged in previous audits,” Cetus clarified, addressing community confusion. “The root cause was a faulty left-shift overflow check that incorrectly validated values beyond safe limits.”
The Cetus team detected strange activity within 10 minutes of the hack and quickly paused trading. They also contacted Sui (SUI) validators who voted to freeze the attacker’s wallets. This action stopped roughly $162 million of stolen funds from being moved off the network. However, the rest was already bridged to Ethereum (ETH).
Cetus said it will now re-audit its contracts, improve its monitoring systems, and roll out a plan to help users recover lost funds. It’s also working with ecosystem partners on a liquidity recovery plan and has urged Sui validators to support on-chain votes aimed at helping users recover funds.
The incident caused a drop in total value locked on the Sui network, from $2.13 billion to around $1.92 billion. CETUS, the platform’s token, fell by 40%, and the loss of liquidity briefly caused USD Coin (USDC) to lose its dollar peg.
Some community members praised the quick response from Sui validators, while others raised concerns that the ability to freeze wallets shows a lack of decentralization. Cetus has also reached out to the hacker with a $6 million “white hat” bounty, inviting them to return the funds, keep the reward, and avoid legal action.
