Fake tokens exploited in $220M heist on Sui’s top DeFi DEX Cetus, shaking the blockchain’s biggest protocol.

Cetus Protocol, the largest decentralised exchange and liquidity provider on the Sui blockchain, suffered a major exploit on May 22, 2025, in which an attacker used fake “spoof” tokens to drain more than $200–260 million in assets from its liquidity pools. The attacker deployed worthless tokens (such as BULLA and other spoof assets) into Cetus pools and exploited flaws in the protocol’s smart contracts and pricing/reserve calculations, including arithmetic overflow and oracle-style price manipulation, to make the contracts treat these fake tokens as if they had substantial value. By distorting price curves and internal reserves, the exploiter repeatedly withdrew real assets like SUI, USDC and other Sui‑based tokens while contributing almost no genuine liquidity, making this one of the largest DeFi hacks of 2025. The incident triggered a wider crisis across the Sui DeFi ecosystem. As major pools on Cetus were drained, several Sui‑based tokens crashed and liquidity across the network seized up, while the CETUS token itself plunged sharply in the immediate aftermath. Cetus paused its smart contracts and began an investigation, working with the Sui Foundation and validators, who intervened to freeze a large portion (around $160–$180 million) of the stolen funds, reducing the exploiter’s realized gain to an estimated $60 million‑plus that was bridged to Ethereum and partially converted to USDC and ETH. The response has sparked an intense debate in the crypto community over oracle design, smart‑contract auditing, and the implications of validator‑level fund freezes for the ethos of decentralisation and censorship resistance in DeFi.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• How attacker used fake tokens to swipe $220m from Sui DeFi ... (dlnews.com)
• Breaking! Cetus Protocol Suffers $260M Exploit Using Fake Tokens ... (binance.com)
• Inside the $260M Cetus Protocol Hack and the Lessons for DeFi ... (bingx.com)
• Understanding the Cetus DEX exploit on Sui - TradingView (tradingview.com)
• Major Breach Hits Sui Ecosystem: Cetus DEX Drained of Over $200M (blockhead.co)

Explore the topic

• USDC
• DEX
• DeFi
• SUI