BlueMove Drains 700,000 SUI From Sui Ecosystem Pools Via Backdoor

Published by James Harris on July 12, 2026July 12, 2026

The liquidity pools backing dozens of Sui ecosystem tokens were drained on July 11, with onchain observers pointing directly at BlueMove, a decentralized exchange built on Sui, as the source. Tyler Simpson, founder of Quantum Void Labs, wrote that BlueMove “pulled all of the TVL in every single pool,” estimating losses at more than 700,000 SUI. A separate onchain message cited by Defimon Alerts put the dollar figure at roughly $400,000, while other estimates from observers range up to $550,000. BlueMove had not issued a public response as of publication.

The mechanism alleged here is not a typical exploit from an outside attacker. Simpson claims the BlueMove team shipped the backdoor themselves, pointing to a package upgrade on May 31 executed by the upgrade cap holder. That version, which Simpson labeled v12, reportedly added a function to return added liquidity alongside a double-mint mechanism that inflated LP tokens. The package was then made immutable immediately after, locking the backdoor in place before anyone could reverse it.

When “Locked” Liquidity Is Not Locked

The projects hit were those that had launched and bonded through MovePump, a bonding-curve launchpad for smaller and meme-oriented tokens on Sui. Crucially, these pools were treated by project teams as locked liquidity, a standard trust signal in early-stage token launches. They were not locked in any meaningful technical sense. One account noted that Beeg Blue Whale, a project whose primary liquidity sat in the MovePump contract, saw its liquidity effectively wiped out. The onchain message seeking to recover funds even offered the drainer a 30 percent white-hat bounty to return the rest within 48 hours, a negotiating tactic that has become almost ritualized in DeFi incidents and rarely works.

The precedent here is less the spectacular bridge hacks of 2022 and more the slow-exit pattern seen across dozens of smaller DeFi protocols that quietly sunset without formal announcement. BlueMove has done this before: in August 2023, the project shut down its operations on Sei Network within 72 hours, citing trading volume below expectations. A team willing to abandon a chain that quickly is also a team operating with minimal long-term accountability to its users.

What This Signals About Sui’s Ecosystem Health

The timing is hard to ignore. Two days before the drain, Simpson had publicly written that Mysten Labs and the Sui Foundation had pushed away most projects built on the chain, leaving only a handful of protocols with real institutional backing. He also stated he had warned the network about BlueMove specifically three times. Whether or not those warnings were acted on, the episode illustrates a structural problem common to newer L1 ecosystems: the long tail of protocols that launch during a chain’s growth phase often persist well past the point of active development, with users unaware that the team has effectively moved on.

This matters more now than it would have in 2021, when liquidity was abundant and losses like this were absorbed into broader market euphoria. In the current environment, incidents that destroy smaller token charts and drain pools that projects treated as permanent infrastructure tend to accelerate capital concentration toward chains and protocols with verifiable security practices. For Sui specifically, the question is whether the ecosystem’s institutional layer, the WAL and DEEP projects Simpson himself cited as surviving, can maintain credibility while the protocol’s long tail continues to generate incidents like this one.

The Upgrade Cap Problem Nobody Talks About

The technical detail worth sitting with is the upgrade cap. On Sui, smart contract packages can be upgraded by whoever holds the upgrade capability, and making a package immutable afterward is a deliberate design choice, not an accident. Simpson’s account suggests the BlueMove team used this mechanism precisely: upgrade the package to include the backdoor, then freeze it so the change appears permanent and trustworthy. This is not a bug in Sui’s design, but it is a reminder that “immutable” only means something if the code was clean before it was frozen. Any project or user relying on immutability as a security guarantee needs to verify what was in the package at the moment it was locked, not just that locking occurred.