Cetus Protocol hack — May 2025
Incident facts
| Date of incident | |
|---|---|
| Target type | Decentralised exchange |
| Loss | $223,000,000Published estimates range $223,000,000 to $260,000,000Price at time of incident |
| Recovered | $162,000,000 |
| Method | Contract logic errorOverflow in the checked_shlw helper of the integer-mate maths library |
| Chains | Sui, Ethereum |
| Outcome | Partially recovered |
What happened
Cetus, the largest decentralised exchange on Sui, lost about $223m on 22 May 2025.
The fault was an overflow in checked_shlw, a helper in the third-party integer-mate maths library Cetus used for liquidity and pricing. The overflow made the calculation of tokens required to claim a position return one. Depositing a single token therefore returned the liquidity of a full position, and the attacker repeated this across multiple pools.
Sui validators froze about $162m of the proceeds that were still on the chain; roughly $60m had already been bridged to Ethereum. The frozen funds were later returned to the protocol after a community vote. Cetus restored the affected pools using the recovered funds, $7m of its own reserves and a $30m USDC loan from the Sui Foundation, and offered to drop legal action in exchange for the return of the remainder, alongside a $5m bounty for information leading to an arrest.
Some early coverage put the loss as high as $260m; the figure that settled in later analysis is $223m, and both are recorded.
Sources
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Cetus Protocol hack — May 2025", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/cetus-protocolhttps://itokenly.com/hacks/cetus-protocolPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.