Cetus Loses Funds in DeFi Smart Contract Attack

Cetus, a prominent player in the decentralized finance (DeFi) space, recently disclosed a significant theft incident that occurred on May 22. The incident involved a sophisticated smart contract attack targeting the CLMM liquidity pool. The attacker exploited an undiscovered vulnerability in an open-source library, manipulating the pool price and establishing a position in a high-zone area. By leveraging an overflow check defect, the attacker artificially inflated liquidity and performed repeated liquidity removal operations to extract pool assets. This was achieved by exploiting unchecked calculation functions, ultimately leading to the theft of significant funds.

In response to the incident, Cetus took immediate countermeasures to mitigate the impact. With the support of Sui validators, Cetus urgently froze two Sui wallet addresses belonging to the attacker, which contained the majority of the stolen funds. However, the remaining stolen funds were exchanged by the hacker and cross-chain transferred to the Ethereum mainnet.

Cetus is now collaborating with the Sui security team and multiple audit institutions to re-examine the contract and conduct a multi-party joint audit. This thorough review aims to ensure the safe restoration of CLMM services after verification. Additionally, Cetus plans to strengthen on-chain monitoring, initiate additional audits, and regularly publish security reports to enhance overall security measures.

To compensate affected liquidity providers (LPs), Cetus is developing a recovery plan in collaboration with ecosystem partners. The company is also calling on validators to support on-chain voting to accelerate the return of user assets and rebuild trust. As legal procedures continue to advance, Cetus has provided the attacker with a white hat return opportunity, issuing a final ultimatum to encourage the return of the stolen funds. Cetus remains committed to transparency and will continue to update the community on any developments related to the incident.