On the afternoon of May 22, CETUS, the leading DEX liquidity protocol on the Sui chain, suddenly fell sharply, and the price was almost "cut off", while multiple token trading pairs on Cetus also fell sharply. Subsequently, a number of KOLs posted on X that the Cetus protocol LP pool had been attacked by hackers.

On-chain monitoring shows that the Cetus attackers appear to have taken control of all SUI-denominated LP pools, with more than $260 million stolen at the time of writing. At present, hackers have started to convert funds to USDC and exchange them to ETH on the Ethereum mainnet, and about 60 million USDC have been transferred across chains.

The hacker's on-chain address is: 0xe28b50cef1d633ea43d3296a3f6b67ff0312a5f1a99f0af753c85b8b5de8ff06. At present, the most important assets in this address are still SUI and USDT, but the mainstream tokens of the Sui ecosystem such as CETUS, WAL, AND DEEP are also included, which shows that the scope of this hack is extremely wide.

The Cetus team has not given a clear response to this matter at this time, but one team member said in the project's Discord chat that the Cetus protocol was not stolen and that there was an "oracle bug". Sui officials said that they will actively support the Cetus team in their ongoing investigation and will provide further updates as soon as possible.

Of course, the on-chain data doesn't lie, according to statistics, the LP pool of the Cetus protocol has lost more than $260 million in this incident, and the amount stolen has exceeded the protocol's TVL ($240 million) and market capitalisation ($180 million). At the time of writing, the CETUS price had fallen from $0.25 in the afternoon to $0.17, and the project's prospects were uncertain.

Community opinion points out that the team has a "history of theft"

Interestingly, when Cetus caused the collapse of the SUI ecosystem, many community members also pointed out on Twitter that Cetus was developed by the same team as Crema Finance, a former Solana-based DeFi protocol, and Crema had been stolen.

On July 3, 2022, Crema Finance was also attacked by hackers using Solend flash loans, and the LP pool was drained, losing more than $8 million. Then on July 7, the hackers returned $7.6 million worth of stolen cryptocurrency after consulting with the team. According to the negotiated agreement between the two parties, the hackers were allowed to keep 45,455 SOL ($1.65 million) as a bounty.

There is no public information to prove that Crema and Cetus were developed by the same team, but for now, the reasons for the theft are the same.

With an ecological market share of more than 60%, can the Sui ecosystem still recover?

According to DeFiLlama data, Cetus has been the leading DEX and liquidity gathering place in the Sui ecosystem, accounting for more than 60% of the entire ecosystem. This "clearance" attack undoubtedly directly destroyed the liquidity centre of the ecosystem, and for any "second-tier public chain", this is a devastating blow.

Since March last year, the trading volume on the Sui ecosystem has been on an overall upward trend, and the prices of mainstream ecological tokens such as CETUS, DEEP, WAL have also been soaring, and are widely regarded by the community as the public chain with the most potential for return in this cycle and the "next Solana".

However, interestingly, according to Dune data, there have been a large number of wash trades on the Sui chain, and the flow toxicity of the ecosystem has been close to 50% for a long time, which is part of the reason why the community has reported that the Sui ecosystem "has nothing, but the price has been rising".

Illustration: The circle radius in the figure below shows the total transaction volume of a single address, and you can see that the wallet with the largest transaction volume also has a high transaction frequency, indicating that there may be a wash transaction; Source: Dune Analytics

According to CoinGecko data, SUI, DEEP, WAL and other ecological mainstream tokens have all fallen due to this incident, but it seems that they have stopped falling.

However, Sui's "strong banker" persona has been set up in the minds of traders for a long time, and in the copycat recovery market in the past month, Sui is also the most eye-catching one in the mainstream public chain. In the face of this major ecological theft, can the Foundation give an effective response and once again strengthen its "strong village" personality?