TL;DR:
- Affected amount: Approximately 700,000 SUI tokens, valued at nearly $500,000, were drained from the protocol’s locked liquidity pools.
- Origin of the flaw: The platform attributed the incident to an arithmetic overflow bug in its legacy Automated Market Maker (AMM) contract, which has been visible since 2023.
- Contingency measures: The project’s management offered a 30% white hat bounty to the attacker and promised to compensate affected users if the funds are not returned.
Last weekend, funds were drained from the locked pools of BlueMove DEX, an exchange developed on the Sui network. The extracted sum exceeds $500,000. The event triggered debates within the crypto community, with various users and independent researchers suggesting the possibility that the incident stems from an internal manipulation vector.
Tyler Simpson, founder of Quantum Void Labs, published screenshots showing that the unauthorized withdrawal affected more than 700,000 SUI tokens from the liquidity pools. Simpson initially labeled the activity as a direct illicit action by the platform.
BlueMove team shipped the backdoor themselves.
They upgraded the package on May 31 (by the upgrade cap holder):https://t.co/t0smmnd8LO
Earlier same day: https://t.co/nHlXz1NNcF
v12 added add_liquidity_returns + double-mint LP inflation. Package made immutable immediately… pic.twitter.com/CB2wFyNLCn
— Tyler Simpson (@quantumvoidlabs) July 12, 2026
Subsequently, the researcher shifted his stance toward the hypothesis of a structural exploit, pointing out that BlueMove allegedly introduced an upgrade package on May 31 that facilitated the subsequent drain. His technical analysis claims that this upgrade included immutable functions aimed at inflating liquidity provider (LP) tokens through double-mint mechanisms, with the first anomalous withdrawals manifesting more than 40 days after its implementation.
Technical discrepancies and smart contract limitations
BlueMove rejected all claims of internal fraud through a publication on its official website. The company argued that an external attacker exploited a long-standing arithmetic overflow bug in its AMM v1 contract to compromise a total of 389 liquidity pools simultaneously.
The team’s technical specifications reveal that the code error had been exposed since 2023. However, a recent upgrade overlooked this flaw and permanently burned the technical governance mechanism known as UpgradeCap on June 3. Internal data suggests that this event eliminated any on-chain path to apply direct corrective patches or conventionally freeze the affected package.
The development team stated that definitively containing the issue would require independent administrative capabilities external to the contract or an absolute migration to a fully audited contract architecture.
Negotiation process and compensation plan
In order to mitigate the financial impact, the platform’s administrators sent a direct message to the blockchain address linked to the attacker. The communication proposed a white hat bounty agreement, allowing them to retain 30% of the stolen capital—approximately $150,000—on the condition that they return the remaining 70% within a maximum period of 48 hours.
The company assured that if the sender does not return the money within the stipulated time, it will initiate the corresponding legal actions. The project also detailed that it will fully compensate the losses of affected users with its own capital should the negotiation fail, a scenario under which they are considering the permanent shutdown of their operations in the crypto market.
For the time being, trading and deposit activities within the platform remain completely suspended while forensic audits on the contracts are deepened. An official spokesperson for Sui Network was consulted regarding the vulnerability and asset recovery strategies, limiting their response to stating that they would not issue comments on the current state of the investigation.
Be the first to comment