2026-09-08

This month

Smart contract exploits and DeFi hacks in the last 48 hours

On May 22, 2025 , Cetus Protocol, the largest concentrated-liquidity DEX on Sui, suffered a catastrophic exploit that drained liquidity across multiple pools, resulting in an estimated ~$223 million i…

RESEARCH: Smart contract exploits and DeFi hacks in the last 48 hours

https://blocksec.com/blog/cetus-incident-one-unchecked-shift-drains-223m-largest

On May 22, 2025 , Cetus Protocol, the largest concentrated-liquidity DEX on Sui, suffered a catastrophic exploit that drained liquidity across multiple pools, resulting in an estimated ~$223 million in losses. This incident stands as the largest DeFi hack of 2025, highlighting critical vulnerabilities in smart contract security, particularly concerning fixed-point arithmetic.

Root cause: a flawed overflow guard in checked_shlw() used an incorrect threshold, allowing unsafe u256 left shifts in fixed-point math to pass.

Citation: BlockSec

https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2024/

Over the last few years, cryptocurrency hacking has become a pervasive and formidable threat, leading to billions of dollars stolen from crypto platforms and exposing vulnerabilities across the ecosystem. As we revealed in last year’s Crypto Crime Report, 2022 was the biggest year ever for crypto theft with $3.7 billion stolen. In 2023, however, funds stolen decreased by approximately 54.3% to $1.7 billion, though the number of individual hacking incidents actually grew, from 219 in 2022 to 231 in 2023.

Key observations:

  • DeFi hacks saw a 63.7% drop in total value stolen from $3.1 billion in 2022 to $1.1 billion in 2023.
  • The number of individual hacking incidents rose, indicating that while the financial impact per incident declined, the frequency remained high.

Citation: Chainalysis

https://owasp.org/www-project-smart-contract-top-10/

The OWASP Smart Contract Top 10 provides a comprehensive overview of the most critical vulnerabilities in smart contracts, serving as a guideline for developers and auditors to enhance security measures.

Citation: OWASP

Summary

In the last 48 hours, the most significant development is the $223 million exploit of Cetus Protocol on Sui, marking the largest DeFi hack of 2025. The decline in stolen funds from crypto platforms in 2023—despite a rise in hacking incidents—highlights both improved security measures and an increased frequency of attacks targeting decentralized finance (DeFi) protocols.

Key Developments

  • May 22, 2025 — Cetus Protocol on Sui was exploited for approximately $223 million due to a flawed overflow guard in the checked_shlw() function, allowing unsafe u256 left shifts in fixed-point math to pass. BlockSec
  • 2023 Overview — Total crypto funds stolen decreased by ~54.3% to $1.7 billion, with a notable drop in DeFi hacking losses (63.7%) but an increase in the number of incidents. Chainalysis
  • Smart Contract Security — OWASP's Smart Contract Top 10 outlines critical vulnerabilities to guide secure smart contract development and auditing practices. OWASP

Sources

  1. BlockSec – Cetus Incident: One Unchecked Shift Drains $223M in the Largest DeFi Hack of 2025
  2. Chainalysis – Crypto Hacking and Stolen Funds Report for 2023
  3. OWASP – Smart Contract Top 10 Project

Summary

Key Developments

Sources