SUI LP provider Cetus DEX exploited as SUI pools drained in hack

Cetus DEX is facing an exploit as SUI pools are drained. The main SUI LP provider lost liquidity, leading to stalled swaps. 

Cetus, one of the main DEXs on the SUI network, is facing an exploit. Users report price anomalies, and data shows SUI pools have been drained. The hack may have originated within the Cetus DEX itself, affecting the liquidity of the SUI token.

Cetus did not announce the exploit or its origin. The attack was fast and affected the markets within minutes, but soon after that, prices and liquidity started to recover. 

Hackers sacked top SUI LP provider

The initial loss from the attack was estimated at $11M, coming from the biggest liquidity pool on the DEX. The SUI/USDC pool later recovered its pricing data, but continued with only $2.5M in USDC liquidity.

The exploiter address started out with over $12M in assets over a total of 267 different coins and tokens. Within an hour, the wallet only contained $5M. Binance’s founder Changpeng ‘CZ’ Zhao announced the exchange would assist with intercepting funds. 

We are doing what we can to help SUI. Not a pleasant situation. Hope everyone stay SAFU!

— CZ 🔶 BNB (@cz_binance) May 22, 2025

All Cetus pools are being drained, affecting additional meme token prices. Some of the assets lost over 80% of their value, then rapidly rebounded, creating price anomalies. Users are also reporting failed swaps or slower DEX responses. 

25 min ago

Cetus, main LP provider DEX on $SUI, allegedly hacked.

$11M in $SUI drained from SUI/USDC pool, with most tokens down 75%+ as pools are emptied. pic.twitter.com/kl74FQubMX

— VM_TRADE (@VM_TRADE1) May 22, 2025

The exploit affected multiple liquidity pools, tanking the price of meme tokens by as much as 78% within minutes, mostly due to the effect of drained liquidity pools. The attack arrived at a time when Cetus handled over $294M in daily volumes. 

The drained pools are affecting all tokens and are unrelated to any specific rug pulls targeting those assets. On-chain research shows the attacker holds over 12M USDC at another address and may have drained additional SUI pools. Some of the USDC is already on the move, to be potentially laundered. 

The effect of erratic prices was mostly due to the draining of the SUI/USDC pool, which in turn affected all meme tokens trading against SUI.

Cetus DEX was attacked at peak liquidity

Cetus was attacked at a moment when the DEX had recovered its liquidity near all-time highs. The DEX carries $241.3M in total value locked, after rapid growth in the past month. The attacked pools make up a small fraction of the entire available liquidity. 

SUI also increased its available liquidity to an all-time high, carrying $2.2B in total value locked, in addition to $1.15B from stablecoins. The chain expanded its lending, while Cetus remains the third-largest app based on locked liquidity.

In the past month, Cetus increased its value locked by 70%, as all DEXs responded to the general crypto market recovery. According to on-chain data on the SUI L1 chain, Cetus has 62,117 users and is the second most active app on the chain. Recently, the DEX reported over $7.15M in daily fees, with a higher baseline activity in May.

SUI itself remains safe and has rarely reported hacks or exploits. The SUI ecosystem is a rare target for hackers due to its small scale relative to the Ethereum network. SUI saw only $84M of inflows from other chains in the past three months and is still a relatively small arena for on-chain activity.

Following the news of the exploit, the SUI token sank from $4.18 to $4.00, still trading near its three-month peak. SUI is represented on Binance, OKX, and Coinbase, but the loss of Cetus as the main liquidity provider may affect the price. Cetus may also have to recover or rebuild liquidity.

KEY Difference Wire: the secret tool crypto projects use to get guaranteed media coverage