Sui Bridge Claim Bot Sent $392K to the Cetus Attacker

On 16 October 2026, an automated bot finalized stale unclaimed Sui Bridge withdrawals on Ethereum, eight of which came from the Cetus exploiter's Sui address. The attacker received 86 ETH, 109,000 USDT and 0.9 WBTC, roughly $392K. No contract bug was involved: transferBridgedTokensWithSignatures() never checks the sender or recipient.

• Bot finalized 8 withdrawals from the Cetus exploiter's Sui address to its Ethereum wallet
• Attacker received 86 ETH, 109,000 USDT and 0.9 WBTC, about $392K
• Root cause is not a contract bug: the function never screens sender or recipient
• 109,000 USDT and 0.9 WBTC remain in the attacker's wallet, USDT not yet frozen