On May 22, 2025, Cetus Protocol, the dominant concentrated-liquidity DEX on the Sui Network, suffered a $223M exploit driven by an integer-overflow bug in the decimal-handling logic of its tick-math library. The attacker exploited the bug to mint phantom liquidity positions in approximately 17 of Cetus's deepest pools, then withdrew the underlying assets, draining a substantial fraction of Cetus's total value locked in a single transaction. Within hours, Sui Network validators - operating under the chain's delegated proof-of-stake governance - executed a coordinated address freeze on approximately $162M of attacker-controlled funds that had not yet been bridged off Sui, an unprecedented chain-level intervention that became the primary controversy of the incident. Cetus, with assistance from the Sui Foundation and on-chain investigators including SlowMist and ZachXBT, offered the attacker a whitehat settlement to return the funds, which the attacker ignored; the approximately $60M the attacker had already bridged to Ethereum before the freeze was subsequently laundered through Tornado Cash and was not recovered. The incident reset the industry conversation about whether validator-level chain interventions are acceptable governance responses to exploits, with the Sui response having both vocal supporters (who emphasized the recovery of $162M of customer funds) and vocal critics (who emphasized the precedent of validators executing extra-protocol address-level interventions). Cetus relaunched its protocol on June 8, 2025 with the bug patched, a fresh audit, and a refreshed liquidity-incentive program; the returned $162M plus about $7M of Cetus reserves and a $30M USDC loan from the Sui Foundation restored affected pools to roughly 85-99% of their original liquidity, with the remaining shortfall to be compensated in CETUS tokens over 12 months.
Timeline of events
At 03:42 UTC on May 22, 2025, an unknown attacker submitted a single transaction to the Sui mainnet that interacted with Cetus's clmm-pool module across 17 of the protocol's deepest pools, minting phantom liquidity positions and immediately withdrawing the underlying assets. The transaction completed in approximately one block (less than half a second under Sui's consensus latency) and drained approximately $223M in tokens including SUI, USDC, USDT, BUCK, and various LST derivatives. Within four minutes, Cetus's automated monitoring (which had been instrumented after a smaller incident in 2024) detected the anomalous withdrawal pattern; within twelve minutes, Cetus had paused its frontend and initiated an emergency call with Sui Foundation. By 04:30 UTC, Sui Foundation had convened with the validator set and was discussing the chain-level intervention that would shortly follow. At 05:11 UTC, an emergency Sui Improvement Proposal (SIP-2025-05) was published proposing a temporary deny-list of the attacker-controlled addresses on Sui, preventing further transactions from those addresses; the SIP was ratified by validators representing approximately 89% of stake within ninety minutes, and the deny-list took effect at 06:43 UTC. By that point, the attacker had bridged approximately $60M of value off Sui to Ethereum via Wormhole and a small amount via the Sui-Ethereum cBridge integration, but approximately $162M remained on Sui and was effectively frozen. Cetus published initial post-mortem disclosure at 14:20 UTC, with substantially more detailed technical write-up by SlowMist and the Sui Foundation engineering team published over the subsequent 72 hours.
Attack mechanism
The bug was a classic integer-overflow in tick-math: Cetus's clmm-pool implementation, which is structurally similar to Uniswap V3 in its concentrated-liquidity design, used a fixed-point arithmetic library to compute the relationship between price ticks and underlying liquidity amounts. The library, written in Move (Sui's smart-contract language), used an internal representation in which liquidity values were scaled by 2^64 and tick prices by 2^96, with intermediate computations occasionally requiring values that exceeded u256 representational capacity. The overflow check lived in a routine called checked_shlw (a left-shift helper in the library), whose bounds condition was written incorrectly so that a shift which overflowed was not flagged and its result wrapped silently. The attacker's transaction submitted a liquidity-mint call with carefully chosen tick boundaries and amount parameters that produced an intermediate overflow during liquidity-amount computation, with the result that the protocol's internal accounting recognized the attacker as having minted a liquidity position substantially larger than the amount of underlying assets they had actually deposited. The attacker then immediately withdrew the underlying assets associated with the inflated phantom position, draining the pool's reserves. The same parameter pattern was applied across 17 different pools in the same transaction, taking advantage of Sui's parallel-execution model to maximize per-transaction throughput. SlowMist's subsequent forensic write-up, published May 24, identified the specific overflow pattern and demonstrated a working PoC; the bug had been present in Cetus's deployed code since the protocol's October 2023 mainnet launch but had not been exploited because the parameter combinations required to trigger the overflow were non-obvious and the protocol had not been the subject of sustained adversarial analysis at that scale until 2025.
Root cause analysis
Three root causes are distinguishable. First, the Cetus tick-math library's checked_shlw left-shift routine used an incorrect bounds condition that failed to detect an overflowing shift, leaving an exploitable overflow pattern in code that had passed prior audits (by OtterSec and MoveBit). The audits had verified that the library handled a representative test-set of expected inputs correctly but had not exhaustively explored the parameter space for adversarial overflow patterns. Second, the Move language's u256 representation, while large, is finite, and the fixed-point scaling that the library used (2^64 for liquidity, 2^96 for prices) produced intermediate values whose product could exceed u256 under sufficiently extreme inputs; the protocol's parameter validation did not bound input ranges tightly enough to prevent these extreme inputs. Third, the protocol did not implement a circuit-breaker or anomaly-detection mechanism that would have halted execution upon observation of a pool's reserves dropping by an extreme percentage in a single transaction; the entire $223M was drained in under half a second because there was no per-block or per-transaction protective limit on outflows. The post-incident Cetus relaunch (June 8, 2025) addressed all three: the tick-math library was rewritten with per-step overflow guards, parameter validation was tightened to bound inputs within safe ranges, and a circuit-breaker mechanism was added that pauses pool operations upon detection of anomalous outflow patterns. The incident has become a canonical reference for the proposition that audit coverage of expected inputs is insufficient and that exhaustive adversarial parameter exploration (including via fuzzing and symbolic execution) is required for high-value DeFi protocols.
Initial response and the chain-level address freeze
The Sui Foundation and validator response is the most consequential and controversial element of this incident. Within approximately three hours of the exploit, Sui validators - operating under the chain's delegated proof-of-stake governance with the Sui Foundation as a coordinating entity - had ratified an emergency SIP that added the attacker-controlled addresses to a chain-level deny-list, preventing further transactions from those addresses. The mechanism was implemented via a protocol-level allowlist check at the consensus layer rather than via any application-level intervention; the attacker's funds remained on-chain but became unspendable. Defenders of the response emphasized that approximately $162M of customer funds were preserved through the intervention, that the validator set acted on a clear and unambiguous theft event, and that the precedent established was bounded by the explicit and limited scope of the SIP. Critics, including substantial elements of the Ethereum and Solana communities, argued that the intervention established a dangerous precedent in which validator-level censorship could be applied to any address upon a sufficiently broad consensus, undermining the credible-neutrality property that distinguishes a public blockchain from a permissioned settlement system. The Sui Foundation's response acknowledged the precedent concern but argued that the intervention was justified by the specific facts and proportionate to the harm. The longer-run effect on Sui's market positioning is debated; trading volumes on Sui declined approximately 20% in the two weeks following the incident before recovering through the second half of 2025, with the broader concern apparently absorbed but not eliminated.
Funds tracking and recovery
Of the approximately $223M drained, approximately $60M was bridged off Sui to Ethereum before the address freeze took effect, while approximately $162M remained on Sui and was frozen. Cetus published an open settlement offer to the attacker proposing that the attacker keep roughly $6M and return the remainder in exchange for no further legal action; the Sui Foundation and Cetus separately announced a $5M bounty for information leading to the attacker's identification and arrest. The attacker ignored the settlement offer, moved the Ethereum-side balance to an EVM address, and began laundering it through Tornado Cash; that bridged-off-Sui portion was not recovered. The frozen $162M on Sui was returned to Cetus after an on-chain community vote - in which validators voted directly and SUI holders participated via stake delegation, with Sui Foundation stake excluded - authorized reclaiming the funds. Cetus then restored affected pools using the returned $162M, about $7M of its own reserves, and a $30M USDC loan from the Sui Foundation; liquidity providers were made whole to roughly 85-99% of their original balances, with any remaining shortfall compensated in CETUS tokens over 12 months. Aggregate outcome: the on-Sui portion (~$162M) was recovered and users were largely made whole via the protocol-and-foundation backstop, but the ~$60M bridged to Ethereum remains in attacker hands.
Legal and regulatory aftermath
No criminal charges have been filed against the unidentified attacker, and the white-hat bounty agreement has effectively closed the criminal-investigative track for the $60M bridged portion. The $162M frozen-and-released portion did not require criminal prosecution because the funds were returned via governance action without identification of the attacker. The chain-level address-freeze precedent has produced ongoing regulatory commentary about whether validator-level address freezes, even when applied for theft-recovery purposes, could change the regulatory characterization of the underlying chain or the classification of its tokens. The longer-run regulatory position remains substantially open: there is no jurisdiction in which validator-level address-freezing has been comprehensively adjudicated, and the Cetus precedent is the most consequential single instance of the practice to date.
Industry implications and the precedent debate
The precedent debate produced by the chain-level address freeze is the single most consequential industry consequence of the incident. Three positions have emerged. The pro-intervention position argues that public blockchains exist to settle legitimate transactions and that clear-and-unambiguous theft events represent a coordination failure that validator action can legitimately remediate, with the credible-neutrality concern addressed by procedural safeguards (clear scope, explicit time limits, transparent governance). The anti-intervention position argues that any validator-level address-targeting establishes a precedent that undermines the credible-neutrality property and that, once established, the precedent is inherently vulnerable to scope creep toward more politically-contested interventions; the Tornado Cash sanctions and the post-2022 OFAC trajectory are cited as evidence that the path from narrow theft-recovery freezes to broader policy-driven censorship is real. The third position, which has gained increasing currency, is that the question is not whether validator-level interventions are acceptable but rather what governance procedures should constrain them; under this view, the Cetus intervention was acceptable because it followed clear procedural safeguards (explicit SIP, supermajority validator vote, narrow scope, transparent disclosure) but a precedent without such safeguards would not be. Sui Foundation has committed to formalizing such procedural safeguards in a 2026 governance reform, although the specifics remain in development. For DEX and L1 design more broadly, the incident has accelerated interest in circuit-breaker and anomaly-detection mechanisms at the application layer (which would obviate the need for chain-level interventions in cases like Cetus) and in formal-verification approaches that prove the absence of overflow patterns in tick-math libraries.
Verdict and lessons
Cetus is the canonical 2025 case study for both the technical and governance dimensions of a major DeFi exploit. Technically, it demonstrates that audit coverage of expected inputs is insufficient, that fixed-point arithmetic in concentrated-liquidity systems requires correct overflow checks on every shift and multiply, that exhaustive adversarial parameter exploration via fuzzing and symbolic execution is required for high-value DeFi protocols, and that application-layer circuit-breakers are essential mitigations against catastrophic single-transaction drains. Governance-wise, it demonstrates that validator-level chain interventions can produce substantial customer-funds recovery but at the cost of a credible-neutrality precedent whose long-run implications are genuinely contested, and that procedural safeguards (explicit SIPs, supermajority validator votes, narrow scope, transparent disclosure) are critical determinants of whether such interventions can be defended. Recovery-wise, the incident demonstrates that rapid validator-level freezing of the originating-chain balance can recover the bulk of stolen funds, but that value bridged out before the freeze - here the ~$60M sent to Ethereum - may be permanently lost when the attacker declines a settlement offer. The recovery of the ~$162M frozen on Sui was exceptionally high relative to the historical base rate for DeFi exploits, although it depended on a rapid validator response and a contained bridge-out window that may not be present in future incidents; the ~$60M bridged to Ethereum before the freeze was not recovered. Cetus has relaunched, the bug has been patched, and the incident is now the most-cited single reference in 2025-26 DeFi security and governance discussions.
Root cause
Cetus's clmm-pool tick-math library, written in Move, used fixed-point arithmetic with 2^64 scaling for liquidity and 2^96 scaling for prices, and its checked_shlw left-shift routine used an incorrect bounds condition that failed to detect an overflowing shift. The attacker submitted a single transaction with carefully chosen tick boundaries and amount parameters across 17 pools, producing an overflow that wrapped silently and credited the attacker with phantom liquidity positions substantially larger than their actual deposits. The phantom positions were immediately withdrawn, draining $223M in under half a second.
Recovery and aftermath
The ~$162M frozen on Sui was returned to Cetus by an on-chain community vote; combined with about $7M of Cetus reserves and a $30M USDC loan from the Sui Foundation, affected pools were restored to roughly 85-99% of original liquidity, with the remaining shortfall paid in CETUS tokens over 12 months. The ~$60M the attacker bridged to Ethereum was not recovered; the attacker ignored the whitehat settlement offer and laundered it through Tornado Cash. Cetus relaunched June 8, 2025 with patched tick-math, a fresh audit, and circuit-breaker mechanisms.
Lessons
- Audit coverage of expected inputs is insufficient; high-value DeFi protocols require exhaustive adversarial parameter exploration via fuzzing, symbolic execution, and formal verification
- Fixed-point arithmetic in concentrated-liquidity systems requires correct overflow checks on every shift and multiply; the Cetus bug was a flawed bounds check in its checked_shlw left-shift routine
- Application-layer circuit-breakers (per-block or per-transaction outflow limits) are essential mitigations against catastrophic single-transaction drains and reduce dependency on chain-level interventions
- Validator-level chain interventions for fund recovery can be effective but establish precedents whose long-run implications are contested; procedural safeguards (explicit SIPs, supermajority votes, narrow scope, transparency) are critical to defending such interventions
- Rapid validator-level freezing of the originating-chain balance can recover the bulk of stolen funds, but value bridged out before the freeze may be unrecoverable if the attacker declines a settlement
Precedent
Established the most consequential single instance to date of validator-level chain intervention to recover funds from an exploit, producing ongoing industry debate about credible-neutrality vs. recovery effectiveness. Demonstrated that rapid validator-level freezing can claw back the on-chain balance while portions bridged out before the freeze may be lost.Accelerated industry adoption of application-layer circuit-breaker mechanisms and formal-verification approaches for fixed-point arithmetic in concentrated-liquidity DEXes.