“As of earlier today, we have confirmed that an attacker has stolen approximately $223M from Cetus Protocol.
We have took immediate action to lock our contract preventing further theft of funds. $162M of the compromised funds have been successfully paused.
We are working with the Sui Foundation and other ecosystem members right now on next-step solutions, with the goal of recovering the remaining stolen funds.“
There was an incident detected on our protocol and our smart contract has been paused temporarily for safety. The team is investigating the incident at the moment. A further investigation statement will be made soon. We are grateful for your patience.”
Lookonchain reported that approximately $60 million in USDC had already been transferred across chains at the time of reporting.
Meanwhile, Cetus Protocol’s native token, CETUS, plunged over 24% to $0.15 as of press time, according to CryptoSlate’s data.
“The stolen funds mostly belonged to the LPs of the DEX. But this also caused a lot of Sui token prices to crash, affected normal users as well. The SUI token itself seems to be holding up relatively fine so far though, only down slightly for the day.”
Early analysis suggests the exploit may be linked to a flaw in the protocol’s pricing mechanism.
He added that the team needs to:
“Check the math behind addLiquidity, removeLiquidity, and swap functions — especially where they Compute token ratios, Round small values, and Handle tokens with decimals = 0.”
Earlier today, a member of the Cetus team posted to Discord that the platform was “not hacked, we’ve detected a bug in the oracle.” The general consensus among Crypto Twitter now appears to support oracle manipulation as the cause of the exploit.
Cetus Protocol employs a dual approach to oracles within its ecosystem:
