{"investigation":{"slug":"cetus-protocol","entity_name":"Cetus Protocol","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.85,"status":"published","content_type":"investigation","summary":"Cetus Protocol is a concentrated liquidity market maker (CLMM) decentralized exchange deployed on the Sui and Aptos blockchains. On May 22, 2025, the protocol suffered one of the largest DeFi exploits in history when an attacker exploited an integer overflow vulnerability in its smart contract math library to drain approximately $223 million from liquidity pools. Roughly $162 million was frozen on-chain through emergency validator action by the Sui network, and following a governance vote the protocol relaunched in June 2025 with partial user compensation.","sections":[{"content":"Cetus Protocol is a decentralized exchange using a Concentrated Liquidity Market Maker (CLMM) model, deployed primarily on the Sui blockchain with a secondary deployment on Aptos. It was established as Sui's official launch partner DEX and grew to become the leading DEX on Sui by trading volume, TVL, and user count. The protocol raised a seed round in May 2023 from investors including OKX Ventures, KuCoin Ventures, NGC Ventures, Animoca Brands, IDG Capital, and Coin98 Ventures. A strategic round with Sui followed in February 2024. The team is led by co-founder Henry Du, though comprehensive public information about the founding team remains limited. At its peak before the May 2025 exploit, Cetus held a leading TVL position within the Sui ecosystem and had integrated with Coinbase Onramp for user onboarding.","heading":"Background and Protocol Overview","sources":[{"url":"https://tokeninsight.com/en/coins/cetus-protocol/team","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/cetus","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/developer-platform/discover/customer-stories/cetus","name":"coinbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 22, 2025, beginning at approximately 10:30 UTC, Cetus Protocol was exploited for approximately $223 million in what security researchers identified as an integer overflow attack. The vulnerability resided in the checked_shlw function within the integer-mate u256 fixed-point math library used by Cetus's CLMM contract. This function was designed to prevent overflow when performing left-bit-shift operations during liquidity calculations, but contained two critical flaws: it compared against an over-wide mask (0xFFFFFFFFFFFFFFFF << 192 instead of the correct 0x1 << 192) and used an incorrect comparison operator (> instead of >=). The attacker initiated flash loans to obtain liquidity atomically, then opened a concentrated liquidity position in an extremely narrow tick range of approximately [300000, 300200]. By selecting a liquidity value that passed the flawed overflow check but triggered an overflow during actual calculation, the attacker was able to deposit only one token while receiving a disproportionately large liquidity credit. The attacker then called remove_liquidity against the inflated accounting position to extract substantial pool reserves, repaid only the flash loan component, and retained the remainder as profit. The exploit was executed across multiple transactions. Security researchers at Cyfrin, Halborn, QuillAudits, BlockSec, and SlowMist all independently analyzed the vulnerability and reached consistent technical conclusions. Notably, a similar overflow vulnerability had reportedly been identified in a 2023 audit of the Aptos deployment, but was not carried over to the Sui codebase.","heading":"The May 2025 Exploit: Technical Analysis","sources":[{"url":"https://www.cyfrin.io/blog/inside-the-223m-cetus-exploit-root-cause-and-impact-analysis","name":"cyfrin.io","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-cetus-hack-may-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/cetus-protocol-hack-analysis","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/cetus-incident-one-unchecked-shift-drains-223m-largest","name":"blocksec.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-analysis-of-the-230-million-cetus-hack-ee569af040f2","name":"slowmist.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The total value extracted in the exploit was approximately $223 million. Of this, roughly $60 million was bridged to Ethereum within the first hours of the attack and was not recovered. The remaining approximately $162 million remained on the Sui network and was frozen through emergency validator action before it could be bridged out. The CETUS token fell from approximately $0.26 to $0.15 in under 24 hours following news of the exploit, a decline of over 40%. The broader Sui ecosystem suffered immediate liquidity disruption: affected pools were emptied, USDC liquidity effectively disappeared, and numerous Sui ecosystem tokens experienced extreme drawdowns within minutes. Security researchers identified that the same underlying integer_mate library flaw affected other Sui-based protocols including Kriya, Momentum, and Bluefin, which were patched following the Cetus incident.","heading":"Financial Impact and Fund Disposition","sources":[{"url":"https://www.cyfrin.io/blog/inside-the-223m-cetus-exploit-root-cause-and-impact-analysis","name":"cyfrin.io","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/cetus-protocol-hacked-for-more-than-200-million","name":"elliptic.co","type":"other","credibility":3},{"url":"https://thedefiant.io/news/hacks/cetus-protocol-hit-223-million-hack-162-million-frozen-5-million-bounty-vote-on-c13985eb","name":"thedefiant.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Cetus Protocol underwent multiple security audits prior to the exploit. Known audits include a MoveBit audit in April 2023 covering the original Aptos deployment, an OtterSec audit, a Cyberscope audit, and a Zellic audit completed in April 2025 — approximately one month before the hack. The vulnerability in the checked_shlw function went undetected across all audits. Security researchers attributed this to two main factors: first, the integer_mate library was reportedly not included in scope for some audits; second, a common assumption among Move-ecosystem auditors that the Move language's built-in overflow protections apply universally, when in fact bit-shift operations intentionally permit overflows in Move. The Zellic audit completed just one month before the hack was particularly notable given the proximity to the exploit. A related overflow bug had been flagged in a 2023 Aptos codebase audit; researchers noted that when the protocol was ported to Sui, it appears the Aptos-era security findings were not systematically reviewed for applicability to the new deployment.","heading":"Audit History and Security Failures","sources":[{"url":"https://github.com/CetusProtocol/Audit","name":"github.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-cetus-hack-may-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/web3-security/multi-layer-audit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.quantumcanary.org/insights/cetuss-223-million-hack-what-went-wrong-and-what-we-learned","name":"quantumcanary.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the exploit, Sui network validators coordinated emergency action to block the attacker's addresses on-chain, freezing approximately $162 million before it could be bridged to other networks. A governance proposal was subsequently put to a validator vote to formally transfer the frozen funds to a multi-signature wallet controlled by Cetus, the Sui Foundation, and blockchain security firm OtterSec. On May 29, 2025, the vote concluded with 90.9% of stake weight voting in favor, 1.5% abstaining, and 7.2% not participating. The action sparked a significant debate in the crypto community about Sui's degree of decentralization. Critics argued that validators' ability to unilaterally freeze user funds — even those held by an alleged attacker — erodes the trustless nature of blockchain networks and sets a precedent for future censorship that could be compelled by regulators or misused in other contexts. Proponents countered that the intervention enabled victim restitution and was a proportionate response to theft. The episode was widely cited as illustrating the tension between effective governance and decentralization principles in proof-of-stake networks.","heading":"Sui Validator Emergency Action and Decentralization Debate","sources":[{"url":"https://www.dlnews.com/articles/defi/sui-validators-votes-hack-the-cetus-hacker-and-return-160m/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/sui-vote-on-162m-frozen-cetus-funds-sparks-decentralization-debate-finance-redefined-may-23-30","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/blockchains/sui-validators-vote-to-restore-usd162-million-to-hacked-cetus-users","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/sui-community-approves-release-of-162m-in-tokens-frozen-during-cetus-hack/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Cetus Protocol relaunched on June 8, 2025 at 03:00 UTC, approximately 17 days after the exploit. The recovery was funded through a combination of the $162 million in frozen on-chain assets recovered via the governance vote, $7 million from Cetus's own treasury, and a $30 million USDC loan from the Sui Foundation. Liquidity pool recovery rates ranged between 85% and 99% depending on individual pool exposure. Following relaunch, the protocol restored approximately $120 million in TVL, representing roughly 50% of its pre-exploit peak, and retained its position as the leading DEX in the Sui ecosystem. For user compensation, Cetus allocated 15% of the total CETUS token supply to a compensation contract, including the entirety of the team's remaining unvested tokens (10% of total supply), distributed linearly over 12 months beginning June 10, 2025. A $5 million bug bounty was offered for information leading to recovery of the approximately $60 million bridged to Ethereum. The protocol also committed to open-sourcing its Move contracts and implementing additional security measures including updated audit processes.","heading":"Recovery, Relaunch, and Compensation","sources":[{"url":"https://www.coindesk.com/business/2025/06/09/sui-s-cetus-dex-is-back-online-after-usd223m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/cetus-protocol-relaunches-restores-over-50-tvl-after-usd220-million-exploit","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/cetus-relaunches-protocol-after-recovering-162m-from-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3},{"url":"https://medium.com/@CetusProtocol/cetus-relaunch-incoming-recovery-plan-and-the-road-ahead-9fc0f8bd5c41","name":"medium.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/357386/sui-dex-cetus-protocol-restarts-platform-after-recovering-from-223-million-exploit","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-04","event":"MoveBit completes security audit of Cetus Protocol's Aptos deployment; a similar overflow vulnerability is reportedly flagged but not later applied to the Sui deployment.","source":"","date_original":"2023-04-01"},{"date":"2023-05","event":"Cetus Protocol raises seed round from OKX Ventures, KuCoin Ventures, NGC Ventures, Animoca Brands, IDG Capital, and others.","source":"","date_original":"2023-05-01"},{"date":"2024-02","event":"Cetus Protocol raises strategic round with Sui Foundation investment; protocol establishes itself as leading DEX on Sui.","source":"","date_original":"2024-02-01"},{"date":"2025-04","event":"Zellic completes a security audit of Cetus Protocol approximately one month before the exploit; the integer_mate library vulnerability goes undetected.","source":"","date_original":"2025-04-01"},{"date":"2025-05-22","event":"Cetus Protocol exploited for approximately $223 million beginning at 10:30 UTC via integer overflow in checked_shlw function. Roughly $60 million bridged to Ethereum; $162 million frozen on Sui by validator emergency action.","source":""},{"date":"2025-05-22","event":"CETUS token falls over 40% from approximately $0.26 to $0.15. Sui ecosystem liquidity severely disrupted; related protocols Kriya, Momentum, and Bluefin identified as sharing the same library flaw and patched.","source":""},{"date":"2025-05-22","event":"Cetus Protocol pauses affected smart contracts. Sui validators coordinate to block attacker addresses on-chain.","source":""},{"date":"2025-05-29","event":"Sui governance vote concludes: 90.9% of validator stake approves transferring frozen $162 million to multisig wallet controlled by Cetus, Sui Foundation, and OtterSec.","source":""},{"date":"2025-06-08","event":"Cetus Protocol relaunches at 03:00 UTC with 85-99% liquidity pool recovery. Protocol backed by $162M recovered funds, $7M treasury, and $30M Sui Foundation loan.","source":""},{"date":"2025-06-10","event":"Compensation token distribution begins: 15% of CETUS total supply allocated to affected users, distributed linearly over 12 months.","source":""}],"sources_used":[{"url":"https://tokeninsight.com/en/coins/cetus-protocol/team","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/cetus","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/developer-platform/discover/customer-stories/cetus","name":"coinbase.com","type":"other","credibility":3},{"url":"https://www.cyfrin.io/blog/inside-the-223m-cetus-exploit-root-cause-and-impact-analysis","name":"cyfrin.io","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-cetus-hack-may-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/cetus-protocol-hack-analysis","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/cetus-incident-one-unchecked-shift-drains-223m-largest","name":"blocksec.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-analysis-of-the-230-million-cetus-hack-ee569af040f2","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/cetus-protocol-hacked-for-more-than-200-million","name":"elliptic.co","type":"other","credibility":3},{"url":"https://thedefiant.io/news/hacks/cetus-protocol-hit-223-million-hack-162-million-frozen-5-million-bounty-vote-on-c13985eb","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://github.com/CetusProtocol/Audit","name":"github.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/web3-security/multi-layer-audit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.quantumcanary.org/insights/cetuss-223-million-hack-what-went-wrong-and-what-we-learned","name":"quantumcanary.org","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/sui-validators-votes-hack-the-cetus-hacker-and-return-160m/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/sui-vote-on-162m-frozen-cetus-funds-sparks-decentralization-debate-finance-redefined-may-23-30","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/blockchains/sui-validators-vote-to-restore-usd162-million-to-hacked-cetus-users","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/sui-community-approves-release-of-162m-in-tokens-frozen-during-cetus-hack/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2025/06/09/sui-s-cetus-dex-is-back-online-after-usd223m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/cetus-protocol-relaunches-restores-over-50-tvl-after-usd220-million-exploit","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/cetus-relaunches-protocol-after-recovering-162m-from-exploit/","name":"unchainedcrypto.com","type":"other","credibility":3},{"url":"https://medium.com/@CetusProtocol/cetus-relaunch-incoming-recovery-plan-and-the-road-ahead-9fc0f8bd5c41","name":"medium.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/357386/sui-dex-cetus-protocol-restarts-platform-after-recovering-from-223-million-exploit","name":"theblock.co","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:25:04.236873+00:00","updated_at":"2026-08-29T01:33:37.37+00:00"}}