Cetus Protocol, the largest decentralized exchange (DEX) and liquidity provider on the Sui network, has been drained of $260 million worth of tokens in an apparent hack, according to crypto sleuth Lookonchain.
The Cetus team has paused the smart contracts and is actively investigating, it said in an X post. According to early analysis, the attacker used spoof tokens like BULLA to exploit broken price curves and reserve calculations.
They then added near-zero liquidity to manipulate internal LP state and repeatedly removed real assets like SUI and USDC without depositing anything meaningful.
https://twitter.com/d0rsky/status/1925513235987394721
Cetus confirmed the incident on X, saying the contract has been paused “for safety” and that a detailed statement will follow.
CETUS is down 40% in the past few hours, while Sui-based memecoins like BULLA and MOJO have dropped over 90%.
UPDATE (May 22, 12:00 UTC): Updates headline and story with additional details.