Cetus CLMM

On May 22, 2025, an attacker drained roughly $223 million from Cetus Protocol, at the time the largest automated market maker on the Sui blockchain, by exploiting a bug in the math library behind its concentrated-liquidity (CLMM) pools. Sui validators froze about $162 million of the stolen funds on-chain within hours, though a portion had already been bridged out to Ethereum. A post-incident analysis commissioned from security firm Dedaub traced the root cause to a miswritten overflow check in the pool's liquidity-calculation logic (crypto.news).

How the attack worked

The attacker opened a flash loan for 56,700 SUI, requiring no real capital of their own, then created a concentrated-liquidity position spanning an extremely narrow price range — about 200 ticks wide — and funded it with a minimal amount of a token they controlled, as little as a single unit (Rekt). The function that converts a token deposit into an internal liquidity credit divides by a value tied to the width of the price range; with the range narrow enough, that division produced a number so large it overflowed the integer type. Instead of rejecting the oversized result, the check truncated it — but the liquidity actually credited to the position stayed disproportionate, reportedly on the order of 10^34 units from a deposit of one token. Withdrawing from that over-credited position returned real tokens far exceeding what was deposited, enough to repay the flash loan and keep the rest. The attacker repeated the pattern across effectively every Cetus pool within roughly fifteen minutes.

Several outlets describe this as a "spoof token exploit" because the tokens funding the positions were largely worthless or attacker-created rather than assets with real market value (Observers). That label captures the entry point but not the mechanism: no oracle or price feed was manipulated — the bug in the liquidity math made the deposited token's real value irrelevant to begin with.

What happened next

Cetus paused its contracts within about ten minutes of detection, but roughly $60 million had already crossed to Ethereum via Wormhole before the remaining assets could be stopped. Sui validators then coordinated an emergency measure to blacklist the attacker's addresses holding the remaining $162 million — an option available specifically because of Sui's validator coordination, not something possible on a chain like Ethereum or Bitcoin. Cetus offered a $6 million bounty for the voluntary return of funds; the attacker never responded, and the offer was later replaced by a $5 million reward for information leading to identification. Cetus and the Sui Foundation committed to covering losses to traders, liquidity providers and token holders from Cetus's own treasury plus a bridge loan from the Foundation, regardless of whether the frozen funds were recovered (Cryptopolitan). On May 29, 2025, validators representing about 91% of Sui's stake approved an on-chain proposal to move the frozen $162 million into a multisig wallet jointly controlled by Cetus, auditor OtterSec and the Sui Foundation, to be released once Cetus executed its repayment plan (CryptoSlate). Cetus relaunched on June 8, 2025 with patched contracts, reporting liquidity largely restored (DeepNewz). Other Sui protocols built on similar CLMM code were found to share the same vulnerable pattern and had to patch independently.

What this means

• Concentrated-liquidity AMMs depend on exact fixed-point tick math; an overflow or truncation bug there is a distinct risk class from oracle manipulation or reentrancy, and it is invisible to anyone not specifically auditing the arithmetic edge cases.
• Porting a contract to a new chain does not carry over prior audit coverage — the vulnerable logic reportedly traced back to an earlier version of the code and resurfaced after migration to Sui.
• There was no signal an end user or liquidity provider could have observed beforehand; this was a code-level defect, not a market condition to watch for.
• Recovery depended on Sui's validators being able to coordinate a rapid freeze and a subsequent stake-weighted vote — a capability tied to that chain's specific validator set, not a general property of DeFi that applies elsewhere.