Sui Perps Exploit Victims Get a Sheet, A Warning, and a Monday Deadline

Aftermath Finance releases a full list of wallets hit in the $1.1M Sui Perps exploit. Compensation claims open Monday, but some balances may not match.

A Google Sheet, shared publicly by @AftermathFi on X, lists every wallet caught in the April 29 exploit that drained roughly $1.1 million from the protocol’s perpetuals product on Sui.

Compensation claims don’t open until Monday. The team wants users to check their row before then.

The Row That Might Not Match What You Lost

“Some balances may need reconciling because of withdrawals taken during the under-collateralized window,” Aftermath posted on X. Anybody whose amount looks off is being asked to open a Discord ticket or DM the team directly with their transaction data.

The affected accounts sheet is accessible at the full Google Sheets link published by the team. Not everyone’s number will be clean.

One thing that can happen now, though: idle collateral. In a separate post on X, @AftermathFi confirmed users with collateral sitting in accounts can already withdraw it without waiting for Monday.

How $1.1M Left in Under 40 Minutes

The breach itself played out fast. As previously reported, the attacker first appeared on April 28 with 405 SUI. By the following morning, roughly 278 USDC in seed collateral had been assembled via a SOR swap.

What came next was systematic. According to Aftermath’s full postmortem on X, seventeen drain attempts followed between 08:55 and 09:31 UTC on April 29. Eleven landed. Six didn’t.

The root was a signed integer flaw in the integrator accounting logic. An attacker could register as their own integrator, set a negative 100,000 taker fee, and pull synthetic collateral out as real USDC. Each of the 11 successful transactions was a single PTB that opened two accounts, executed a market order against a real counterparty, then withdrew.

The vulnerability was introduced August 29, 2025. @osec_io audited the changes in November. The issue was missed.

After the drain, proceeds moved through fresh single-use wallets. Per @AftermathFi’s postmortem, roughly $250K USDC went to Binance, about $400K USDC to KuCoin, approximately $150K in SUI to HTX, and around $150K USDC to HitBTC, all within roughly 80 minutes. Sui’s security concerns have been building across multiple protocols in recent weeks.

AI Tooling, A Second Audit, and What Comes Next

The team isn’t relaunching AFperps immediately. An additional audit is underway with a separate firm, @AftermathFi said. Manual review, the team acknowledged directly, “is insufficient in 2026.”

That framing has become common. Aftermath noted it was among nearly a dozen protocols hit by exploits this week alone. The response now includes a heavier investment in AI-security workflows, though no specifics on tooling were shared.

Blockaid, ZeroShadow, OtterSec, the Sui Foundation, and Mysten Labs all received acknowledgment for rapid response. The broader protocol, including afSui, pools, farms, aggregator, and SOR, remained untouched throughout.

Monday is still the claims date. Row reconciliation before then is what the team is asking for.

The post Sui Perps Exploit Victims Get a Sheet, A Warning, and a Monday Deadline appeared first on Live Bitcoin News.