The BlueMove Exploit:
A Full Breakdown — and a Hand to Every Affected Project
1 The exploit — 11 July 2026
An attacker exploited a liquidity-provider accounting bug (LP-token inflation) in BlueMove's legacy AMM. In one night — 11 July, 20:46–23:43 UTC — they cycled add/remove liquidity across roughly 394 pools and drained the paired asset (mostly SUI) out of each. MovePump is BlueMove's launchpad, so every coin bonded there had its core liquidity locked on BlueMove — and lost it at once.
Money trail ~714,000 SUI (~$525K) taken and laundered
The attacker funnelled the proceeds into a fresh same-day cash-out wallet, converted it to wrapped BTC + USDC through DeepBook and Cetus, and moved it out. Both wallets have been dormant since 11 July.
2 Why coins are STILL collapsing — the faucet
This is the part most people have missed. When the drain emptied the SUI side of every pool to almost zero, BlueMove never froze the pools. In an automated market maker with ~0 SUI on one side, a tiny SUI input pulls out almost the entire token reserve — every drained pool became a "buy hundreds of millions of tokens for pennies" faucet.
Active One wallet is draining the faucets, coin by coin
On 17 July at 18:39 UTC, a second wallet (not the original attacker) began systematically draining these pools and dumping the near-free tokens into each coin's real markets. In one evening it hit 15+ coins for a total of ~7 SUI — SUITRUMP, PUMPKIN, TOILET, SHOCK, AAA, SUIGETSU, CHILLBULL, PLOP, PEPE, SUIB and more. That single operator sweeping the list is why every affected coin dumped on the same day, at the same time. Arbitrage bots then pile into the dislocations and amplify the move. It is still running.
3 Which coins are still at risk — loaded faucets
I scanned all 394 drained pools. 390 still hold near-full token supply with almost no SUI — every one is a loaded faucet waiting to be drained. Most of those coins have no real market left, so draining them yields little. But a set of coins still have live liquidity elsewhere to dump into — those are the real, ongoing targets right now:
| Token | 24h | Broken BlueMove pool (loaded faucet) |
|---|---|---|
| SUICUNE | −94% | 0x82073645…88d70e9d3 |
| SUIB | −29% | 0xe0577188…09db121c |
| BOB | −45% | 0xdb2a2142…e7fde3fa |
| HOPPER | −39% | 0x1edd2fb4…7647b372 |
| QVL | −33% | 0x787b865f…be06b758 |
| RONDA | −14% | 0xa052785b…4e18cb9a0 |
The full list of all 390 loaded pools is published alongside this report so any project can find its own pool and act. If your BlueMove pool still holds your token balance, assume it is a live faucet until BlueMove freezes it.
4 What every affected project should do now
- Demand BlueMove freeze the drained pools. That is the only thing that closes the faucet permanently. Until they do, anyone can keep minting your token for pennies and dumping it.
- Blacklist your broken BlueMove pool from any router/aggregator your frontend uses, so no stray sell can refill it.
- Warn your holders that the sell pressure is manufactured — near-free tokens from a broken pool — not organic. Panic-selling into it only helps the drainer.
- Protect and rebuild your real liquidity. This is where we can help directly — see below.
◆ How Mischief Finance will help — free
- Liquidity-recovery assistance through SuiDex (suidex.org) — help re-seeding safe, healthy pools so your token has a real home again.
- Free technical support — we'll help you read your on-chain state, identify your loaded pool, and plan a clean relaunch.
- Our voice — we will amplify affected projects and push collectively for BlueMove to freeze the pools and make holders whole.