Sui-based token prices plunge amid $223 million Cetus Protocol exploit

Several Sui-based tokens plunged on decentralized exchanges on Thursday morning amid a $223 million exploit of Cetus Protocol.

Cetus claims to offer the leading DEX and liquidity infrastructure on Sui. However, its liquidity pools were drained of millions of dollars following the attack, with tokens including LOFI and HIPPO dropping over 50% within an hour, according to DEX Screener, and some tokens collapsing more than 90%.

Prices of Sui-based tokens on centralized exchanges initially held up better. However, the liquidity drain also impacted market prices overall, per CoinGecko data. The CETUS token itself fell around 50% on DEXs and 30% overall immediately following the incident.

CETUS/USD price chart. Image: CoinGecko.

"There was an incident detected on our protocol and our smart contract has been paused temporarily for safety," Cetus confirmed on X. "The team is investigating the incident at the moment. We are grateful for your patience."

Analysts at Lookonchain claimed more than $260 million was drained from the protocol, with the attacker converting the stolen funds into USDC, bridging to Ethereum, and exchanging for ETH, estimating around $60 million USDC has been cross-chained so far. Blockchain security firm PeckShield said over $200 million had been stolen, repeating the $60 million bridged USDC figure.

While many in the Sui community claimed that Cetus was not hacked and the incident related to an oracle bug, others said an oracle exploit would be a more accurate description of the issue given the draining of funds and bridging out of USDC.

Cetus later confirmed the amount stolen totaled roughly $223 million but claimed $162 million of the compromised funds had been successfully paused after locking its smart contract — matching the approximate $60 million remaining figure that appears to have been bridged off Sui. "We are working with the Sui Foundation and other ecosystem members right now on next-step solutions, with the goal of recovering the remaining stolen funds," the project said, adding that a full incident report will follow.

"We've learned that a Cetus smart contract was hacked this morning for approximately $223M and Cetus subsequently paused their smart contracts to prevent further theft," the official Sui account posted on X. "Cetus worked together with the other DeFi protocols, the Sui Foundation, and the Sui validators to collectively protect the ecosystem. A large number of validators identified the addresses with the stolen funds and are ignoring transactions on those addresses until further notice."

Updated with the confirmed stolen funds total and additional details from Cetus Protocol and Sui.