Sui Ecosystem Hit by $200M Oracle Exploit on Cetus DEX

A Catastrophic Exploit Rocks the Sui Blockchain

In what’s shaping up to be one of the largest DeFi exploits of 2025, Cetus Protocol, the biggest decentralized exchange on the Sui blockchain, has fallen victim to a devastating oracle manipulation attack.

This highly sophisticated exploit resulted in nearly $200 million in liquidity drained, and the aftershocks have left an entire ecosystem scrambling.

Let’s walk through what happened, the affected tokens, and what this means for Sui’s credibility in the broader crypto space.

What Happened?

According to Cyvers, a blockchain security firm, the attacker used spoof tokens to distort price data inside Cetus’s onchain oracle system. This tricked the smart contracts into believing prices were higher or lower than reality, allowing the attacker to extract vast amounts of real tokens from multiple liquidity pools.

The vulnerable design in price curve calculations and reserve logic gave the attacker access to high-value pairs like SUI/USDC.

Here’s a snapshot of the aftermath:

• Lofi (LOFI) crashed 76%
• Sudeng (HIPPO) dropped 80%
• Squirtle (SQUIRT) fell 97%
• Cetus’s own token dipped by 53%
• 46 tokens across Sui posted double-digit losses

These weren’t just flash crashes—they were brutal, liquidity-draining avalanches that wiped out millions in seconds.

The Numbers Are Shocking

PeckShield’s estimate puts the total damage at roughly $200 million.

Here’s what the attacker managed to do post-exploit:

• $164 million currently held in a Sui wallet
• $61.5 million already bridged to Ethereum in USDC
• Assets are actively being laundered via cross-chain bridges

It’s one of the largest exploits in Sui’s history, and the fact that the attacker is still on the move makes recovery slim to none.

Cetus: Damage Control In Real Time

As soon as the exploit was detected, Cetus paused its smart contracts and issued a public statement acknowledging the incident:

“There was an incident detected on our protocol and our smart contract has been paused temporarily for safety. The team is investigating the incident at the moment.”

Internal Discord messages later leaked, pointing to a bug in Cetus’s price oracle, though many in the community suspect deeper systemic vulnerabilities.

What’s an Oracle Manipulation Attack?

In simple terms, oracles are systems that bring real-world data into smart contracts—like asset prices.

If a hacker can tamper with that data, they can trick a smart contract into mispricing assets, letting them drain liquidity pools for pennies on the dollar.

This is not a new exploit strategy, but it’s usually targeted at smaller, less battle-tested platforms. Seeing it succeed on Sui’s flagship DEX is a massive red flag.

Why This Is a Big Deal for Sui

Sui has been positioning itself as a top-tier Layer 1 blockchain, with funding from major VCs, lightning-fast transaction speeds, and a growing DeFi ecosystem. But this event exposes serious concerns:

• Smart contract security: Are other DeFi protocols at risk too?
• Oracle architecture: Will developers move away from native solutions?
• User trust: Retail and institutional liquidity providers just got rekt

Strangely, the SUI token itself rose 2.2% in the immediate aftermath—likely due to speculative buys and arbitrage. But don’t be fooled—this incident could have ripple effects for months to come.

What Happens Next?

Here’s what to watch for:

• Security Audits Incoming: Expect every major DeFi protocol on Sui to undergo rapid audits.
• Bridges Under Watch: Now that the attacker is moving funds cross-chain, Ethereum and others are on alert.
• Token Relaunches or Forks: Affected tokens like Lofi and Squirtle may try to recover through token rescues or community forks.
• Cetus Compensation Plans: Will the protocol compensate affected LPs? That remains unclear.

Lessons for Investors and Builders

For users and developers alike, this exploit highlights the fragility of DeFi systems that rely on flawed oracle designs.

Key takeaways:

• If a DEX or protocol doesn’t use a secure, tamper-resistant oracle, it’s only a matter of time.
• Always check whether a project has been audited, and by whom.
• Be cautious with newly launched chains—speed without security is a recipe for disaster.
• Cross-chain laundering is still too easy—regulators are watching.

Final Thoughts

This isn’t just another exploit. This is a wake-up call for emerging ecosystems like Sui, which now faces the difficult task of restoring confidence.

The question remains: Can Sui’s ecosystem recover from this massive breach, or will developers flee to safer chains?

One thing is certain—DeFi needs to grow up, and incidents like this prove just how far we still have to go.

If you’re holding Sui tokens, stay alert. And if you’re a developer on the network, now’s the time to double down on security.