Cetus Protocol Exchange Reports Large-Scale Asset Loss Due to Security Flaw

On May 22, 2025, Cetus Protocol disclosed that it experienced a serious security incident involving a malicious attack on its platform. The hacker’s moves involved swapping stablecoins (a type of cryptocurrency designed to keep a stable value, like USDT and USDC), transferring the funds to Ethereum, and converting them into other cryptocurrencies such as ETH.

Their analysis found the attack was carried out by exploiting a vulnerability in the platform’s smart contracts—software programs that run the platform’s operations automatically. In simple terms, there was a mistake in how some calculations were handled, which the attacker exploited to drain the funds.

By finding and taking advantage of a flaw in the code, the attacker was able to manipulate the platform’s liquidity pools, which are the pools of funds used for trading and swapping tokens, and export funds over several transactions.

As soon as the team detected suspicious activity, they acted quickly to stop the attack by disabling parts of the platform to prevent further damage. Cetus identified two wallets on the Sui blockchain controlled by the attacker and blocked them. The remaining stolen assets are now stored across different wallets. Despite these efforts, the hacker was able to transfer amounts to the stolen funds to different wallets—digital addresses that hold cryptocurrencies—and blockchain networks like Ethereum.

In response to the incident, Cetus has been working closely with the Sui Foundation and other partners to recover the remaining stolen funds. The platform has also offered a reward—called a whitehat bounty—to anyone who can return the stolen assets voluntarily.

Looking ahead, Cetus is prioritizing security improvements thorough code reviews, better monitoring of platform activity, and stronger risk controls to prevent similar incidents in the future, and continues to work with its partners and the community to recover the remaining funds and strengthen its security measures.

The incident highlights the ongoing importance of continuous risk awareness in the rapidly changing landscape of decentralized finance, where security threats are continually evolving and underscore the need for robust safeguards and proactive measures.