- Cetus Protocol, the largest DEX on the Sui blockchain, suffered a $223 million exploit through a sophisticated spoof token attack that manipulated its pricing mechanism.
- The team has offered the hacker a $6 million bounty and legal immunity in exchange for returning the stolen assets.
The largest Decentralized exchange which operates on the SUI blockchain woke up to a devastating Thursday after the DEX suffered an exploit that resulted in the loss of approximately $223 million.
In a dramatic turn of events to curb the issue, the protocol is now offering $6 million bounty to the perpetrator in hopes of recovering the stolen assets.
As we earlier reported, the exploit took place on the 22nd of May, targeted a vulnerability within Cetus’ pricing mechanism, specifically its concentrated liquidity market maker pools.
The attacker deployed spoof tokens, fake or low-value assets with manipulated metadata, to distort the internal accounting of the pools. By inserting minimal liquidity and executing complex flash swaps timed with price manipulation, the hacker deceived the system into issuing large amounts of valuable tokens like SUI and USDC at incorrect exchange rates.
According to Cetus’ follow-up statement, the hacker initially drained $11 million from an SUI/USDC pool. The attack then escalated rapidly, with the attacker bridging over $60 million of stolen funds to Ethereum and acquiring more than 21,900 ETH. In total, the hacker now controls millions of dollars in SUI, ETH, and stablecoins across various wallets.
The Clock’s Ticking! Cetus Enters Critical Talks with Hacker
In an effort to recover the massive funds, the Cetus team has identified the attacker’s Ethereum wallet and issued an on-chain message offering a “whitehat settlement.”
The proposal asks for the return of 20,920 ETH and all frozen assets on Sui in exchange for allowing the hacker to keep 2,324 ETH, which is valued at approximately $6 million, and granting immunity from legal consequences. However, Cetus has made it clear that the offer is time-sensitive and contingent upon the funds not being laundered through mixers or off-ramps.
The Cetus team is coordinating with several entities, including law enforcement agencies, the Sui Foundation, the Financial Crimes Enforcement Network (FinCEN), and even the U.S. Department of Defense. Cybersecurity firm Inca Digital is spearheading negotiation efforts with the attacker.
Despite having passed recent security audits, the exploit has raised significant concerns about the reliability of DeFi protocols built on emerging blockchains like Sui and Aptos. The attacker’s strategy—exploiting complex economic logic rather than simple code bugs—proved elusive to standard vulnerability scans.
The Sui ecosystem has been severely impacted. The SUI token plummeted by 15%, while smaller tokens such as AXOL, HIPPO, and SQUIRT were nearly wiped out. CETUS, the native token of Cetus Protocol, dropped between 20% and 33%. Meanwhile, trading volumes spiked as investors rushed to secure their funds, prompting the platform to pause all smart contracts.
Meanwhile, SUI is swapping hands with $3.88 after a short decline of 6.54% in the past 24 hours.
The post Cetus Protocol Hit by $223 Million Exploit — Hacker Offered $6M to Return Funds appeared first on ETHNews.
