What happened to Cetus on SUI? Full breakdown of the situation
Hackers stole $223 million in assets, but were unable to seize the full amount. Cetus developers managed to lock down $162 million
23.05.2025
850
2 min
0
On May 22, the value of many tokens on the SUI blockchain collapsed by more than 80%. The collapse was the result of a hack of the Cetus liquidity protocol. GetBlock AML Research talks about what is known about the hack at the moment.
Another vulnerability
The speed with which attackers managed to withdraw assets from Cetus indicates that internal vulnerabilities were used to compromise the project. The Cetus team has not yet disclosed details on how exactly the hackers managed to gain control of the protocol. Liquidity was moved to the attackers’ addresses within minutes.
The collapse of tokens on SUI after the Cetus hack
The attack on Cetus resulted in the theft of $223 million. The developers of the project reported that they quickly managed to freeze about $162 million and prevent it from being moved further for the purpose of laundering. The attack on Cetus was the second-largest hack in 2025 after the $1,5 billion compromise of the Bybit exchange.
Onchain analysis
After gaining access to Cetus’ liquidity, the hackers conducted a conversion of various tokens on SUI into USDT and USDC stablecoins, which were then moved to the Ethereum blockchain. The stablecoins were soon exchanged for ETH via DEX aggregators.
The chain of asset movements from the SUI blockchain to Ethereum. Data: Elliptic Investigator
Currently, the stolen assets are stored at two addresses:
- 0x89012a55cD6b88e407C9d4ae9B3425F55924919b (3244 ETH, $8,6 million)
- 0x0251536BfcF144B88e1aFa8fe60184Ffdb4cAF16 (20 000 ETH, $53,1 million)
Appeal to hackers
The Cetus team reached out to the attackers and offered a deal that required the hackers to return funds to the project, keeping 2324 ETH ($6 million) as a reward. Cetus added that it is working with the SUI ecosystem, US federal law enforcement, the Seychelles police, and partners in the Department of Defense (of which country is not specified).
Cetus team’s appeal to hackers
Useful material?
Research
The blockchain has helped uncover the ties between cryptocurrency fundraising campaigns, exchangers in Syria, and intermediaries in several countries around the world. A telltale pattern has emerged in which the same addresses were used across multiple donation drives at once
Jun 24, 2026
Research
Four Iranian cryptocurrency exchanges accounted for roughly 78% of all digital asset volume tied to the country in 2025. They have now become the focal point of the largest U.S. sanctions campaign against Iran's cryptocurrency infrastructure.
Jun 5, 2026
Research
A financial system is already up and running on public blockchains, with loans, analogues of U.S. Treasuries, and automated capital markets. More than $551 billion has flowed through DeFi protocols — but most of that activity has nothing to do with the real economy and everything to do with the speculative build-up of risk.
May 29, 2026
Research
Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs
May 22, 2026
Research
For the first time, the new law makes blockchain analytics an officially mandatory tool of financial oversight in the United States. Authorities will also gain the power to restrict transactions with foreign crypto services tied to money-laundering risks.
May 20, 2026
Research
Working with cryptocurrencies requires more than just new technology — it demands a complete overhaul of internal processes. We explain how the financial sector is learning to control digital assets and detect threats
May 8, 2026
Telegram
Twitter