The BlueMove Exploit:
A Full Breakdown — and a Hand to Every Affected Project
1 The exploit — 11 July 2026
An attacker exploited a liquidity-provider accounting bug (LP-token inflation) in BlueMove's legacy AMM. In one night — 11 July, 20:46–23:43 UTC — they cycled add/remove liquidity across roughly 394 pools and drained the paired asset (mostly SUI) out of each. MovePump is BlueMove's launchpad, so every coin bonded there had its core liquidity locked on BlueMove — and lost it at once.
Money trail ~714,000 SUI (~$525K) taken and laundered
The attacker funnelled the proceeds into a fresh same-day cash-out wallet, converted it to wrapped BTC + USDC through DeepBook and Cetus, and moved it out. Both wallets have been dormant since 11 July.
2 Why coins are STILL collapsing — the faucet
This is the part most people have missed. When the drain emptied the SUI side of every pool to almost zero, BlueMove never froze the pools. In an automated market maker with ~0 SUI on one side, a tiny SUI input pulls out almost the entire token reserve — every drained pool became a "buy hundreds of millions of tokens for pennies" faucet.
Active An arbitrage bot is draining the faucets, coin by coin
On 17 July at 18:39 UTC, an arbitrage bot (not the original attacker) started profiting from these broken pools — buying the near-free tokens and immediately reselling them into each coin's real markets for the price difference. In one evening it worked through 15+ coins — SUITRUMP, PUMPKIN, TOILET, SHOCK, AAA, SUIGETSU, CHILLBULL, PLOP, PEPE, SUIB and more. One bot sweeping the list is why every affected coin dumped on the same day, at the same time, and other arbitrage bots pile into the dislocations and amplify it. This is not a targeted attack — it is simply what opportunistic bots always do to broken, unfrozen pools, which is exactly why those pools must be frozen. It is still running.
3 Which coins are still at risk — loaded faucets
I scanned all 394 affected pools. The full breakdown: 9 are already drained empty (the damage is done — this includes SUITRUMP's), ~378 still hold near-full token supply but their coin has no real market left (a loaded faucet, but little to gain from draining it), and 7 are both loaded AND still have live liquidity elsewhere to dump into — those are the real, active targets right now:
| Token | 24h | Broken BlueMove pool (loaded faucet) |
|---|---|---|
| SUICUNE | −94% | 0x82073645…88d70e9d3 |
| SUIB | −29% | 0xe0577188…09db121c |
| BOB | −45% | 0xdb2a2142…e7fde3fa |
| HOPPER | −39% | 0x1edd2fb4…7647b372 |
| QVL | −33% | 0x787b865f…be06b758 |
| RONDA | −14% | 0xa052785b…4e18cb9a0 |
The full list of all 394 affected pools — each labelled loaded / dead-market / already-drained, with balances and addresses — is published alongside this report (CSV) so any project can find its own pool and act. If your BlueMove pool still holds your token balance, assume it is a live faucet until BlueMove freezes it.
4 What every affected project should do now
- Demand BlueMove freeze the drained pools. That is the only thing that closes the faucet permanently. Until they do, anyone can keep minting your token for pennies and dumping it.
- Blacklist your broken BlueMove pool from any router/aggregator your frontend uses, so no stray sell can refill it.
- Warn your holders that the sell pressure is manufactured — near-free tokens from a broken pool — not organic. Panic-selling into it only helps the drainer.
- Protect and rebuild your real liquidity. This is where we can help directly — see below.
◆ How Mischief Finance will help — free
- Liquidity-recovery assistance through SuiDex (suidex.org) — help re-seeding safe, healthy pools so your token has a real home again.
- Free technical support — we'll help you read your on-chain state, identify your loaded pool, and plan a clean relaunch.
- Our voice — we will amplify affected projects and push collectively for BlueMove to freeze the pools and make holders whole.