Summary
On 22 May 2025, Cetus Protocol, the largest decentralized exchange on the Sui blockchain, was drained of about $223 million in the time it takes to read this sentence. The attacker did not steal a key or trick a signer. They found a single wrong constant in an overflow check, buried not in Cetus's own code but in a shared open-source math library, integer-mate, that Cetus and several other Sui projects all depended on. With a one-token deposit and a flash loan, they convinced the protocol that a position worth almost nothing was worth a fortune, then withdrew the real reserves. It is the cleanest modern example of a vulnerability in a dependency draining the protocols built on top of it, and the second largest crypto theft of 2025 after Bybit.
How it happened
Cetus is a concentrated-liquidity decentralized exchange: users supply tokens to pools within chosen price ranges, and the contract math decides how much liquidity a deposit is worth. The vulnerable code was a function called checked_shlw in the integer-mate library, meant to reject a left-shift that would overflow a 256-bit integer. To be safe it had to reject any number with bits set above the 192nd, that is, any value of 2^192 or greater. Instead it compared against the wrong bound, a mask of 0xffffffffffffffff << 192, which is an enormous number, so almost every value that would actually overflow sailed through as "safe." Move, the language Sui contracts are written in, silently truncates on a shift overflow rather than aborting, so the inflated number simply wrapped around to a tiny one. It was a textbook integer overflow, hiding behind a check that was supposed to prevent exactly that.
The attacker turned the wrap into money. Using a flash loan they crashed a pool's price, opened a liquidity position in an extremely narrow price range, and chose a liquidity amount large enough to trip the broken check in the function that computes how many tokens a position requires. The overflow made that calculation round all the way down to a single token. So they deposited one token, were credited an astronomically large position, and withdrew the pool's real reserves, roughly 10 million haSUI, 5.7 million SUI, and more. They repeated it across pools. In minutes, about $223 million was gone.
The shared-library blast radius
The detail that makes Cetus matter is where the bug lived. integer-mate is not Cetus's own code; it is a shared, open-source Move math library that multiple Sui protocols import for their pricing math. The flaw was in the library, not in how Cetus called it, so every project that trusted that overflow check inherited the same hole. Forensic teams found related exposure in other Sui DeFi protocols including Kriya, Momentum, and Bluefin, which patched once the library was fixed (the correct bound is 1 << 192). Cetus had passed multiple audits; none of them caught one wrong constant in a dependency. It is the same class of failure as Curve's Vyper compiler bug, where developers wrote correct code on top of a broken tool. This is a supply-chain attack in the truest sense: the compromised artifact was a library everyone trusted.
The aftermath
Of the roughly $223 million, about $162 million never left Sui. The validators running the network coordinated to ignore the attacker's transactions, freezing those funds in place. That worked, and it was controversial: a network whose validators can socially agree to censor an address is, by definition, not as trustless as advertised, and critics said so loudly. The remaining roughly $60 million had already been bridged to Ethereum and converted to ether, beyond reach. Cetus offered the attacker a time-limited white-hat deal, keep about $6 million and return the rest with no legal action, which went unanswered, plus a separate $5 million bounty for information identifying them. A protocol-wide governance vote then passed with about 91 percent of staked SUI in favour, moving the frozen funds to a recovery multisig. Backed by that, its own treasury, and a $30 million loan from the Sui Foundation, Cetus refilled its pools and relaunched, making users substantially whole. No attacker was ever publicly identified.
Why Cetus still matters
Cetus is the lesson that your dependencies are your attack surface. The protocol's own logic was sound; one incorrect comparison in a library it imported was enough to drain it, and to threaten every other project importing the same library. The defences are the unglamorous ones: pin and audit the exact versions of every dependency, not just your own code; treat third-party math and utility libraries as security-critical and fuzz them at their boundaries, since overflow checks are a classic place for off-by-a-power-of-two mistakes; add independent invariant checks so an impossible position value is rejected even when a library lets it through; and bound withdrawals so a single transaction cannot empty a pool. The bug was never in the app. It was in what the app trusted.
How to fix it
- Patch the integer-mate library to the corrected overflow check (the `1 << 192` bound) and redeploy every contract built against the vulnerable version.
- Pause affected pools, then trace and flag the stolen funds fast; Sui's validator freeze preserved the majority precisely because the response was immediate.
- Add invariant and bounds checks that reject impossible liquidity or token amounts even when a library miscalculates.
How to avoid it
- Pin and audit the exact versions of every third-party library, and re-audit when a dependency ships a security fix.
- Treat shared math and utility libraries as security-critical: fuzz their overflow and boundary behaviour, since one wrong constant can drain everyone who imports them.
- Add independent invariant checks (sane bounds on amounts, liquidity, and prices) so a single bad calculation cannot authorise a drain.
- Cap or rate-limit withdrawals relative to deposits so no single transaction can empty a pool.
- Prefer audited, widely reviewed libraries, and verify deployed bytecode against the reviewed source.
References
- https://dedaub.com/blog/the-cetus-amm-200m-hack-how-a-flawed-overflow-check-led-to-catastrophic-loss/
- https://slowmist.medium.com/slowmist-analysis-of-the-230-million-cetus-hack-ee569af040f2
- https://www.cyfrin.io/blog/inside-the-223m-cetus-exploit-root-cause-and-impact-analysis
- https://www.halborn.com/blog/post/explained-the-cetus-hack-may-2025
- https://www.dlnews.com/articles/defi/sui-validators-votes-hack-the-cetus-hacker-and-return-160m/
- https://www.securityweek.com/223-million-stolen-in-cetus-protocol-hack/
Related vulnerabilities
All Web3 →- CRITICALWEB3-CETUS-2025
On May 22, 2025 Cetus Protocol, the leading DEX on Sui, was drained of approximately $223M. The root cause was a flawed overflow check: the checked_shlw function in the integer-mate math library built its guard mask as 0xFFFFFFFFFFFFFFFF << 192 instead of 0x1 << 192, so values above 2^192 slipped past the check and the subsequent 64-bit left shift silently overflowed (left shifts do not abort in Move). The flaw lived in get_delta_a, which computes the tokens needed for a liquidity position; under the overflow the numerator wrapped to a tiny value, so the function demanded as little as 1 token unit for an enormous liquidity amount. Using flash swaps (borrowing ~10M haSUI), the attacker opened a tight-range position (ticks [300000, 300200]) and minted a massive amount of liquidity for a negligible deposit, then withdrew real pool reserves. Around $162M was frozen on-chain by Sui validators and eventually returned, while roughly $62M was bridged out to Ethereum. Cetus relaunched after recovering and replenishing affected pool liquidity.
- CRITICALWEB3-KYBERSWAP-2023
On November 23, 2023 KyberSwap Elastic was exploited across six chains for over $48M (>$20M Arbitrum, $15M Optimism, $7.5M Ethereum, $3M Polygon, $2M Base, ~$23K Avalanche). The root cause was a rounding-direction bug in the concentrated-liquidity math: estimateIncrementalLiquidity should have rounded delta liquidity up so the final price rounded down, but it used mulDivFloor and rounded delta liquidity down, pushing the computed sqrt price slightly past a tick boundary without legitimately crossing it. Using Aave flash loans, the attacker first swapped to park the price in a liquidity-empty region, calibrated a tight position, then performed extremely precise swaps so the price landed exactly on a tick's sqrt price. This forced _updateLiquidityAndCrossTick to register a crossing in computeSwapStep twice, double-counting the tick's liquidity on the reverse swap and paying out far more output than backed, draining the pools. The attacker later opened negotiations; most funds were not promptly recovered.
- CRITICALWEB3-BUNNI-2025
On September 2, 2025 Bunni, a liquidity manager built on Uniswap v4, was drained of roughly $8.4 million across Ethereum and Unichain (USDC, USDT, and weETH/ETH) through a rounding error in its withdrawal accounting amplified by flash loans. Bunni's Liquidity Distribution Function (LDF) tracks an 'idle balance' that is rebalanced on every swap, and the withdraw path rounded that balance in the wrong direction under specific conditions. The attacker flash-borrowed millions in USDT and executed a precisely sized sequence of swaps that pushed the pool's spot price back and forth across tick boundaries, triggering the faulty rounding repeatedly; each cycle let them withdraw more tokens than they burned in liquidity (in the USDC/USDT pool the idle balance fell 85.7% while liquidity fell only 84.4%, and that gap was the leak). The bug was application-specific accounting math, not an oracle or price-feed flaw. Unable to fund a secure relaunch, the Bunni team announced on October 23, 2025 that it was permanently shutting down, leaving withdrawals open and relicensing v2 from BUSL to MIT.
- CRITICALWEB3-ABRACADABRA-2025
In late March 2025 Abracadabra.Money lost about $13 million (roughly 6,260 ETH) on Arbitrum when an attacker abused the GMX V2 gmCauldrons that accept GMX GM liquidity tokens as collateral. GMX deposits are asynchronous, so the attacker submitted deposit orders with unsatisfiable minOut values that GMX rejected, returning the input USDC to the cauldron's order/router contract while the cauldron's accounting still counted that pending position as live collateral. Functions such as sendValueInCollateral removed real tokens during liquidation without clearing inputAmount/minOut state, so orderValueInCollateral kept reporting phantom collateral. Inside a single cook() batch the attacker borrowed MIM against this ghost collateral, self-liquidated to pull out the real returned tokens, and reborrowed, while the end-of-cook solvency check still read the stale inflated collateral value and passed. The accounting bypass let the attacker borrow against effectively non-existent collateral and extract MIM.
- CRITICALWEB3-VELOCORE-2024
On June 2, 2024, the DEX Velocore was drained of about $6.8 million from its constant-product (volatile) pools on Linea and zkSync Era. The root cause combined a missing access-control modifier with an unchecked arithmetic underflow in the ConstantProductPool fee math: velocore__execute performed Vault-only state changes but had no onlyVault check, so anyone could call it directly. The pool's feeMultiplier, which increases per withdrawal and resets each block to deter free swaps, fed an effective fee computed as fee1e9 * feeMultiplier / 1e9 with no upper bound and inside an unchecked block. By repeatedly invoking velocore__execute to inflate feeMultiplier, the attacker drove effectiveFee1e9 above 100% (> 1e9), so the growth term 1e18 - ((1e18 - k) * effectiveFee1e9) / 1e9 underflowed and wrapped to a huge unsigned value, causing a small single-token withdrawal to be accounted as a massive deposit and mint excessive LP tokens. Linea controversially paused its sequencer for about an hour to stop the remaining funds from bridging out.
- CRITICALWEB3-SONNE-2024
On May 14, 2024 Sonne Finance, a Compound v2 lending fork on Optimism, lost about $20 million when an attacker exploited a freshly created, low-liquidity VELO (Velodrome) market. Because market creation and the protective collateral-factor setup were split across timelocked permissionless transactions two days apart, the attacker acted inside the window before the market was safely seeded. The attacker minted the minimum amount of soVELO cTokens (1 wei) and then donated a large quantity of VELO directly to the soVELO contract, inflating totalCash while totalSupply stayed near zero. Since exchangeRate equals (totalCash + totalBorrows - totalReserves) / totalSupply, this empty-market rounding manipulation drove the cToken exchange rate up so the tiny share position was valued as enormous collateral. The attacker then borrowed roughly 265 WETH plus available USDC.e against the over-valued collateral, draining about $20M within about 25 minutes.