Beeg Blue Whale

1/On July 11, 2026, BlueMove — a DEX on Sui — had 389 liquidity pools drained in a single incident. Roughly 700,000 SUI, somewhere between $400K and $550K. Here's what happened, and what the on-chain data says about one affected token: $BEEG. 🧵 2/The cause is disputed. BlueMove says an attacker exploited an arithmetic overflow bug in its legacy AMM contract — a flaw exposed since 2023. Researcher Tyler Simpson (Quantum Void Labs) alleges BlueMove planted a backdoor in a May 31 upgrade. BlueMove denies it. 3/Both sides agree on one fact that matters more than blame: BlueMove burned its UpgradeCap on June 3. The vulnerable contract can never be patched. Not "hasn't been" — cannot be. There is no on-chain path to fix it. 4/BlueMove offered the attacker a 30% white-hat bounty, said it would compensate users otherwise, and announced it is shutting down. That deadline passed around July 13. No public follow-up since. 5/Now the forensics. I traced $BEEG using Sui's public RPC. Attacker wallet: 0xb29e79…b097335 At 21:58 UTC on July 11, it took ~1.16 BILLION BEEG out of the pool while the swap event logged 34,520 SUI paid in. 6/That SUI never existed. Proof: the pool holds 0.276 SUI today. If 34,520 SUI had genuinely entered and only ~215 left, it would still be sitting there. The logged input is phantom — the signature of an arithmetic overflow. He paid nothing. 7/99 minutes later, at 23:37 UTC, a single transaction chained 12 swaps and dumped his entire haul across 12 tokens: KUN, KOKO, SHOCK, PEPEPIG, SQID, SUIMO, BOATY, NAMI, CTO, PUMPKIN, SUITE, BEEG Total proceeds: ~33 SUI. BEEG's share: 1.65 SUI for 1.73 billion tokens. 8/He wasn't cashing out — he'd already extracted the SUI. This was dumping worthless inventory back into pools he had just emptied. That's what destroyed the charts. His BEEG balance today: zero. He never sent any to another wallet. 9/Then it sat there. For six days. On July 17 at 23:04 UTC, a bot bought 1,732,558,391 BEEG — 99.9% of the dump — out of the abandoned pool. Price paid: 0.5 SUI. About 35 cents. 10/But it never held them. The same transaction bought on BlueMove and sold into Cetus atomically, with a threshold-check call that would revert the whole thing if the trade didn't clear. Net: +735 SUI (~$515) on a 0.5 SUI input. Roughly 1,470x, in one block. 11/That single swap crashed BEEG on Cetus by 99.93% — from 7.91e-6 to 5.39e-9 SUI per token. (Derived from the before/after sqrt prices in the swap event. Cetus is concentrated liquidity — the vault ratio is not the price.) 12/Then the question that actually matters: Did that 1.7B end up in someone's hands, waiting to dump? I scanned every Cetus swap on the pool from July 17–19 — 150,000 events — and cross-checked each buyer against their real wallet balance change. 13/Result: 78–89% of all buying was atomic arbitrage. Bots buying and reselling inside the same transaction. Never held for a block. Only ~495 million BEEG was actually retained by anyone. 14/And it's dispersed. Roughly 50 wallets. Largest holds ~125M — about 1% of total supply. HHI is in the 700–850 range, which is an unconcentrated distribution by any standard measure. About half of them are underwater. They bought the recovery, not the crash. 15/Current state: BlueMove pool: 0.276 SUI / 111K BEEG — dead Cetus: ~415M BEEG / 287 SUI Turbos: ~410M BEEG / 1,134 SUI Combined live liquidity across both: ~$2,700. 16/The number worth sitting with: ~495M BEEG held ≈ 1,330 SUI at current price. Both live pools hold ≈ 1,420 SUI combined. Holders could absorb nearly every SUI available — though the price would crater long before they all got out.