Cetus Protocol Loses $223 Million in Security Breach, Sui Ecosystem Tokens Plummet by 97%

Cetus Protocol, a prominent decentralized exchange (DEX) on the Sui network, experienced a severe security breach that resulted in the theft of approximately $223 million. The attack, which involved the use of spoof tokens, exploited vulnerabilities in the protocol's smart contracts, allowing the attacker to manipulate price data and reserve balances. This manipulation led to the extraction of real assets from multiple liquidity pools, including the SUI/USDC pool. The incident caused a significant drop in the prices of various Sui ecosystem tokens, with popular memecoins like Lofi, Sudeng, and Squirtle seeing their values plummet by 76%, 80%, and 97% respectively within just an hour. The Cetus token itself also experienced a 53% decline following the incident.

In response to the breach, Cetus Protocol took immediate action by freezing $162 million of the stolen funds, successfully recovering a substantial portion of the assets. The team paused the affected smart contracts to prevent further losses and is currently investigating the incident. The protocol has also reached out to the Sui Foundation and ecosystem partners to collaborate on recovering the remaining stolen funds. A full incident report is expected to be released soon.

Binance, one of the leading cryptocurrency exchanges, has stepped in to offer support to the Sui network. Binance co-founder, CZ, took to social media to express his commitment to helping SUI navigate through this challenging situation. He mentioned that Binance is doing everything within its power to assist the network, which could include rescue measures, technical help, or even financial aid through Binance’s SAFU fund. CZ also highlighted that many security teams are working diligently to understand the root cause of the attack and prevent similar incidents in the future.

Industry experts have criticized Circle for its slow response to the attack and delays in freezing stolen funds. It took over five hours during the Bybit hack, and Cyvers CEO Deddy Lavid warned that waiting for post-mortems instead of acting on real-time alerts makes delays as dangerous as doing nothing. This hack is one of the major crypto thefts in recent months, following ByBit’s $1.5 billion breach in February and Coinbase’s insider attack, which cost up to $400 million. The incident underscores the ongoing challenges faced by decentralized finance (DeFi) platforms in securing their systems against sophisticated attacks and the importance of swift and effective responses to mitigate the damage caused by such breaches.