The decentralized finance ecosystem suffered one of its most devastating blows in May 2025, when Cetus Protocol — the largest decentralized exchange operating on the Sui blockchain — lost approximately $260 million in a sophisticated smart contract exploit. The attack, which occurred on May 22, accounted for over 94 percent of all crypto losses recorded during the month, according to the De.Fi REKT report published on May 31. As Bitcoin traded near $104,600 and Ethereum held at approximately $2,529, the exploit sent shockwaves through the DeFi community and raised urgent questions about the security maturity of newer blockchain ecosystems.
The Exploit Mechanics
The attacker identified and exploited a critical vulnerability in Cetus Protocol’s token swap mechanism, the core functionality that powers any automated market maker. Rather than targeting a specific liquidity pool or leveraging a flash loan, the attacker introduced spoofed tokens into the system and manipulated the AMM curve’s price calculations at a fundamental level.
These malicious tokens were crafted to artificially inflate pool reserves and distort trading prices, allowing the attacker to drain real, valuable assets from liquidity pools at severely undervalued exchange rates. The exploit bypassed standard token validation mechanisms entirely, which points to a significant oversight in the protocol’s input verification and curve logic — the foundational layers that should prevent exactly this type of manipulation.
Post-exploit analysis revealed that the attacker’s wallet held a broad range of valuable tokens immediately after the attack. Laundering efforts began quickly, with the attacker swapping stolen assets across multiple venues and transferring funds through various intermediary wallets to obscure the trail.
Affected Systems
The impact of the Cetus exploit extended far beyond the protocol itself. As the largest DEX on the Sui Network, Cetus served as a critical liquidity hub for the entire ecosystem. When the exploit was executed, token prices on the platform crashed — some falling by over 90 percent within minutes. The cascading effect impacted liquidity providers, traders, and any protocol that relied on Cetus for price feeds or swap functionality.
The Cetus team halted all smart contract operations immediately upon detecting the attack, but the damage had already been done. With SUI trading at approximately $3.25 at the time and the network’s total value locked taking a significant hit, confidence in the Sui DeFi ecosystem was severely tested. The exploit also highlighted a broader pattern: May 2025 saw $275.9 million lost across 8 incidents on networks including Sui, Ethereum, Binance Smart Chain, Arbitrum, and Base, with zero funds recovered.
The Mitigation Strategy
In the aftermath of the attack, the Cetus team and the broader Sui community moved quickly to contain the damage. Smart contract operations were paused across all Cetus markets, preventing any further exploitation of the vulnerability. Security auditors were brought in to conduct a thorough analysis of the exploit vector and assess whether similar vulnerabilities existed in other parts of the codebase.
The Sui Network’s validators also coordinated to explore potential recovery options, though the decentralized nature of the blockchain makes fund recovery inherently difficult. The incident sparked discussions about implementing circuit breakers and emergency shutdown mechanisms that could automatically halt suspicious trading activity before losses reach catastrophic levels.
Lessons Learned
The Cetus exploit underscores several critical lessons for the DeFi industry. First, the concentration of liquidity in a single dominant DEX creates systemic risk — when Cetus fell, the entire Sui DeFi ecosystem felt the impact. Diversification of liquidity sources and redundancy in critical infrastructure should be architectural priorities.
Second, newer blockchain ecosystems like Sui, which use novel programming languages such as Move, face a unique challenge: the audit ecosystem is less mature compared to Ethereum’s Solidity landscape. Protocols deploying on newer chains must invest heavily in security audits from multiple firms and implement rigorous testing frameworks that account for language-specific edge cases.
Third, input validation at the smart contract level remains a fundamental weak point across the industry. The fact that the Cetus attacker could introduce spoofed tokens that bypassed verification mechanisms suggests that protocols need to implement multi-layered validation, including checksums, whitelist enforcement, and real-time monitoring of anomalous trading patterns.
User Action Required
For users who had funds locked in Cetus Protocol at the time of the exploit, the immediate priority is to follow official communications from the Cetus team regarding potential recovery plans. Users should avoid interacting with any contracts claiming to offer fund recovery unless they are explicitly verified by the official Cetus team. Additionally, this incident serves as a reminder for all DeFi users to practice risk diversification — never concentrate all holdings in a single protocol, regardless of its size or reputation. Keep recovery phrases secure, enable all available security features on connected wallets, and maintain awareness of protocol-level risks when providing liquidity on any platform, especially those on newer blockchain networks.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any DeFi protocol.
The gap between crypto and TradFi is narrowing fast
spoofed tokens manipulating AMM curve calculations at the fundamental level. this was not a flash loan attack, it was a math exploit on the swap mechanism itself
spoofed tokens inflating AMM reserves is a class of vulnerability that formal verification should catch. the math was wrong at the protocol level, not an edge case
The fundamental value proposition of crypto keeps getting stronger
Mass adoption is happening incrementally — people just don’t notice
$260M being 94% of all crypto losses in may says everything about sui ecosystem maturity. one protocol taking down nearly the entire monthly loss figure
94% of monthly losses from one protocol on Sui. new chains rush TVL growth and skip the security audits. $260M paid for that shortcut
M being 94% of all crypto losses in May says everything about Sui ecosystem maturity. One protocol taking down nearly the entire monthly loss figure.
M being 94% of all crypto losses in May says everything about Sui ecosystem maturity. One protocol taking down nearly the entire monthly loss figure.
M being 94% of all crypto losses in May says everything about Sui ecosystem maturity. One protocol taking down nearly the entire monthly loss figure.
the attacker spoofed token reserves to inflate pool values then drained real liquidity. clever but should have been caught in audit. AMM math needs formal verification