Sui's Biggest Liquidity Provider Hacked for $223M, Causing Sui-Based Tokens to Plummet

Cetus Protocol, the largest decentralized exchange (DEX) and liquidity provider on the Sui network, has been drained of $223 million worth of tokens in an apparent hack, according to Cetus Protocol on X.

The protocol added that $162 million of the stolen funds had been "paused" and it is working with the Sui Foundation to recover the remainder of the funds.

The wallet tied to the Cetus Protocol exploit — 0xe28b50 — currently holds over 12.9 million SUI, valued at approximately $54 million at current prices.

On-chain data shows the address has a net worth exceeding 32.9 million SUI (approximately $137 million), suggesting the attacker may have already bridged or swapped funds through multiple paths.

The wallet remains active at the time of publishing and is likely in the process of obfuscating funds. This confirms the scale of the exploit and further pressures Sui's DeFi infrastructure, as major token pools and pairs remain drained.

The Cetus team has paused the smart contracts and is actively investigating, it said in an X post. According to early analysis, the attacker used spoof tokens like BULLA to exploit broken price curves and reserve calculations.

They then added near-zero liquidity to manipulate internal LP state and repeatedly removed real assets like SUI and USDC without depositing anything meaningful.

Cetus confirmed the incident on X, saying the contract has been paused “for safety” and that a detailed statement will follow.

Binance founder CZ said the exchange's team has reached out to Sui to offer help,.

CETUS is down 40% in the past few hours, while Sui-based memecoins like BULLA and MOJO have dropped over 90%.

UPDATE (May 22, 12:00 UTC): Updates headline and story with additional details.
UPDATE (May 22, 12:13 UTC): Adds further details and CZ tweet.

UPDATE (May 22, 16:40 UTC): Adds response from Cetus Network and updates headline to reflect $223 million figure.