$220 Million Cetus Hack: Security Challenges, Sui Validators' Response, and Lessons for Trust in Web3 Ecosystems

On May 22, 2025, Cetus, a decentralized crypto exchange running on the Sui blockchain network, suffered a massive hack that resulted in the attackers withdrawing approximately $223 million in user funds 1 2 3 . The incident was one of the largest DeFi exploits in the first half of 2025 and had major consequences for the Sui ecosystem and the crypto market as a whole.

Hacking mechanism and attack details

The hackers exploited a vulnerability in Cetus smart contracts , specifically in the pricing mechanism and token validation. They injected fake tokens (such as BULLA) into liquidity pools, which distorted reserve calculations and allowed them to manipulate asset prices. Using flash loans and price curve distortion, the attacker emptied 46 liquidity pairs by exchanging worthless tokens for real assets, including SUI and USDC 1 2 3 5 .

Some of the stolen funds, about $63 million , were transferred to the Ethereum network, where the attackers converted them into about 20,000 ETH , worth about $53 million. The attacker’s Ethereum wallet address, ending in “AF16,” is known to have been used to launder these funds 1 2 .

Response and measures to freeze funds

The Sui network validators responded quickly to the incident: they froze about $162 million of the stolen assets, blocking transactions from the attackers’ addresses. This was done to prevent further withdrawals and preserve the ability to return them to users 7 9 .

The Sui Foundation and the Cetus team are working with other organizations in the ecosystem to recover the remaining funds and return them to those affected. To do this, a vote among Sui network participants is proposed , which will allow the adoption of a protocol update necessary to unlock and return the frozen assets. This approach emphasizes the importance of decentralized governance and transparency in the recovery process 7 .

Appeal to hackers

The Cetus team has publicly approached the attackers with a “white deal” proposal: return about 20,920 ETH and all frozen assets on the Sui network in exchange for keeping 2,324 ETH (approximately $6 million) and protection from lawsuits. This proposal is aimed at minimizing damage to the community and incentivizing the return of funds 1 .

Consequences for the ecosystem and the crypto market

The Cetus hack caused a sharp drop in the value of Sui ecosystem tokens, with the CETUS token falling by more than 40% and SUI by about 15% to around $3.81. Some less liquid tokens lost up to 96% of their value, which seriously affected investors and DEX liquidity 1 3 .

The incident once again highlighted the vulnerability of cryptocurrency projects to cyberattacks and the need for stronger security measures. Discussions arose in the crypto community about the balance between decentralization and the ability of validators to intervene to protect users. Some participants expressed concern that the ability of validators to freeze funds undermines the censorship resistance of the Sui network 1 .

Results and Prospects

The Cetus hack has exposed critical security flaws in DeFi platforms, especially in new ecosystems like Sui 1 3 .
The quick response of the validators and the freezing of funds made it possible to prevent the loss of most of the stolen assets and begin the process of their return 7 9 .
The proposed protocol upgrade vote demonstrates a commitment to decentralized and transparent crisis management, which is important to restore community trust 7 .
Cetus and the Sui Foundation have announced a $5 million reward for information leading to the identification and arrest of the attackers 5 7 .
The Cetus hack has become a serious warning to the entire crypto industry about the need to strengthen cybersecurity and self-organization in the face of growing threats 1 3 .

Thus, the Cetus incident is not only a major theft of funds, but also an important lesson for the entire DeFi ecosystem, highlighting the need for a balance between innovation, security, and decentralization.

Cetus 0M Hack: Security Challenges, Sui Validators' Response, and Lessons for Trust in Web3 Ecosystems

What measures have Sui validators taken to freeze funds and how much does this affect the decentralization of the network?

The Sui network validators have taken steps to freeze funds stolen in the Cetus decentralized exchange hack by ignoring and blocking transactions from addresses associated with the exploit . They identified the addresses to which the stolen assets were transferred and, until further notice, refused to process any transactions from those addresses, effectively freezing approximately $162 million of the more than $220 million in stolen funds 7 1 .

This measure was implemented at the level of validators, which in the Sui network constitute a relatively small number – only about 114 participants. They agreed and approved a plan for the recovery of funds, which allowed for the prompt halting of further movement of the stolen tokens and the beginning of the process of their return to the affected users 1 3 .

Impact on network decentralization

The validators’ actions have sparked intense debate in the crypto community, as the ability to freeze wallets and block transactions calls into question the censorship-resistant and decentralized nature of the Sui network . Critics point out that if fewer than 120 validators can single-handedly block addresses and interfere with transactions, this means centralized control, which is contrary to the ideals of fully decentralized blockchains 7 .

Supporters point out that in the face of serious cyberattacks and security threats, such measures are necessary to protect users and maintain trust in the ecosystem. At the same time, Sui provides for public consensus and voting mechanisms that allow decisions to be made on recovery and refunds, which partially offsets the risks of centralization 1 3 .

Thus, the freezing of funds by Sui validators is a trade-off between security and decentralization . It demonstrates that in modern blockchain networks, especially in new ecosystems, the balance between complete censorship resistance and rapid response to threats has not yet been achieved and is controversial among market participants 1 7 .

Briefly:

Sui validators block transactions from the attackers’ addresses, freezing $162 million in stolen funds.
To do this, they ignore transactions with suspicious addresses until the community makes a decision.
There are only 114 validators in the network, which raises questions about the degree of decentralization.
The measures provide security, but reduce censorship resistance and call into question Sui’s decentralization.
Decisions are made through voting, which partially preserves elements of decentralized governance.

How Attackers Exploited a Cetus Code Vulnerability to Steal $220M and What It Means for DeFi Security

Attackers exploited a vulnerability in the Cetus DEX smart contract pricing mechanism on the Sui blockchain , allowing them to conduct a sophisticated attack and steal approximately $220-260 million . The main exploit method was as follows:

Hackers injected fake tokens into liquidity pools, distorting reserve calculations and asset prices in the protocol.
By exploiting a vulnerability in the validation and pricing algorithms, attackers were able to manipulate prices, creating artificially high or low liquidity values.
This made it possible to withdraw real assets from major pools such as SUI/USDC by exchanging them for fake tokens with inflated value.
The attack utilized flash loans , which allowed large amounts of liquidity to be obtained for a short period of time without collateral, increasing the scale and speed of the exploit.
Over the course of approximately 47 minutes, the attackers conducted a series of coordinated transactions, draining at least 12 liquidity pools and transferring some of the stolen funds to the Ethereum network for further laundering.

What does this mean for DeFi security?

The Cetus hack, one of the largest of 2025, highlights several important issues and lessons for the decentralized finance industry:

Vulnerabilities in smart contracts and pricing mechanisms remain a major risk point for DeFi protocols, especially for new and fast-growing ecosystems.
Complex automated market makers (AMM) algorithms and liquidity pool management require careful auditing and ongoing monitoring to prevent manipulation.
The use of flash loans gives attackers the ability to conduct large-scale attacks without upfront investment, making it difficult to defend against.
The incident highlights the need for stronger security measures , including open source code, bounty programs for white hat hackers, and more stringent smart contract checks and updates.
The hack caused the ecosystem’s token prices to drop, liquidity to decline, and assets to freeze, demonstrating how vulnerabilities can lead to cascading effects in the market.
For new blockchains like Sui, this case was a wake-up call that massive growth and popularity should not come at the expense of security and decentralization.

Overall, the Cetus hack shows that security in DeFi requires continuous improvement of technologies and security mechanisms , as well as active interaction between developers, validators and the community to prevent similar incidents in the future 1 2 3 5 6 .

Why the community is criticizing the ability of validators to block wallets and how this affects censorship in the Sui network

The community’s criticism of the ability of Sui network validators to block malicious wallets is related to the fact that such a practice creates risks for censorship resistance and undermines the principles of decentralization . The main arguments and consequences are as follows:

Censorship resistance is a key principle of decentralized blockchains , meaning that no one can arbitrarily block or reverse transactions. The ability of validators to ignore transactions from certain addresses effectively introduces centralized control, which is contrary to the ideals of the Sui network and many other crypto projects 1 3 .
There are only about 114 validators on the Sui network, and their consensus decision to freeze funds means that a relatively small number of participants can influence the availability of users’ assets. This raises concerns that in the future, such measures could be used not only in emergency situations, but also for political or commercial reasons 3 .
Similar situations have already been observed in other blockchains, such as Ethereum, where validators refused to process transactions from sanctioned addresses, leading to discussions about the network’s vulnerability to external pressure and censorship 1 .
Proponents of such measures point to the need to protect users from theft and fraud , especially in the face of large-scale hacks and attacks, when prompt intervention can save significant funds. However, this creates a dilemma between security and freedom of transactions 1 3 .
Technically, the Sui network uses the Mysticeti consensus mechanism, which provides high throughput and censorship resistance due to parallel block proposals by multiple validators. However, the ability to collectively decide on blocking addresses reduces this level of censorship resistance 4 .
Overall, the criticism reflects a broader problem in the cryptocurrency industry: how to maintain decentralization while effectively combating scammers and attackers without turning the network into a centralized structure with the ability to censor 1 3 5 .

Thus, the ability of Sui validators to block malicious wallets is controversial because it ensures security and refunds, but at the same time compromises the fundamental principles of decentralization and freedom of transactions, increasing the risk of censorship on the network.

What steps is the Cetus team taking to recover stolen funds and possibly return assets to users?

The Cetus team is taking comprehensive steps to recover stolen funds and return assets to users after a hack worth approximately $220 million. Key measures include:

Updating the Sui protocol and transferring frozen funds to a multi-signature (multisig) Cetus wallet, the keys to which will be jointly controlled by the Cetus team, the audit firm OtterSec and the Sui Foundation. This will allow centralized management of the returned assets and ensure their security 1 .
An upgrade to the CLMM (Concentrated Liquidity Market Maker) smart contract , which has been audited and is designed to provide emergency recovery for liquidity pools affected by the hack 1 .
Data recovery and calculation of liquidity losses in each attacked pool, which will allow us to accurately determine the damage and the amount of compensation required 1 .
Asset conversion as some tokens have been corrupted or altered due to the attacker’s actions. The team plans to perform this conversion with minimal impact on the market and liquidity 1 5 .
Developing a compensation contract that will cover the remaining losses of users. This contract is being audited and will become a tool for compensating losses 1 .
Updating peripheral products and modules for the new contract, which will ensure full restoration of DEX functionality and access to liquidity for providers 1 .
Cetus protocol relaunch , scheduled for approximately one week after the plan is approved by the community, with full functionality restored and LPs accessing 1 5 .
Working with the Sui ecosystem and law enforcement to pursue the attackers and recover the remaining funds. Cetus offered the hacker a “white deal” to return most of the stolen assets in exchange for keeping some of the funds and protection from lawsuits, but there was no response 5 8 .
Conducting a community and validator vote on Sui , in which over 90% of participants supported an emergency protocol update that allows frozen funds to be returned without the need for a hacker’s signature, which became a unique solution in the blockchain industry 1 7 .
A plan to reward white hat hackers and move to open source to improve protocol security and encourage collective contributions to secure the network 5 .
Setting aside a portion of CETUS tokens to compensate affected users: 15% of the protocol’s own token supply is allocated for this purpose, with a gradual release over the course of the year 5 .

As such, the Cetus team is implementing a strategy that combines technical upgrades, community coordination, and legal action to restore the DEX to its full functionality and return the stolen funds to users as efficiently as possible.

How hacks like these affect trust in Web3 ecosystems and what lessons can be learned from this incident

Hacks of major DeFi projects like Cetus have a significant impact on trust in Web3 ecosystems and highlight existing security risks in the industry. The main implications and lessons learned from such incidents are:

Impact on Web3 Trust

Growing concerns among users and investors due to large-scale losses of funds reduce the attractiveness of decentralized finance and blockchain projects for a wider audience. The loss of hundreds of millions of dollars undermines the reputation of both specific protocols and the entire Web3 ecosystem.
Such incidents are causing increased regulatory pressure as governments see them as a threat to financial stability and consumer safety, which could lead to tighter controls and restrictions on innovation.
The hacks demonstrate that decentralization does not automatically guarantee security . Code errors, insufficient auditing, and weak security mechanisms remain the main vulnerabilities.
The community and investors are becoming more cautious, which slows down the growth and adoption of new projects, especially if they do not demonstrate a high level of security and transparency.

Lessons to Learn from the Cetus Incident and Other Attacks

The need for comprehensive auditing of smart contracts and infrastructure – regular, deep code and security reviews should become standard for all Web3 projects.
Implement real-time monitoring and analytics to quickly detect anomalies and potential attacks so you can respond quickly and minimize damage.
Developing and implementing multi-level security systems , including multi-signature wallets, asset freezing mechanisms, and other tools that can help prevent or limit the impact of hacks.
Raise awareness and educate developers and users on cybersecurity techniques, including recognizing phishing attacks and social engineering.
Balance between decentralization and security – it is necessary to find compromises that will preserve the principles of openness and censorship resistance, but at the same time ensure that users are protected from major losses.
Active communication and coordination within the ecosystem – joint efforts between developers, validators, auditing companies and the community are important for rapid recovery from incidents and increased protocol resilience.
Transparency and openness in communication with users and investors help maintain trust, even in the event of serious crises.

How Web3 Hacks Affect User Trust in Ecosystem Security

The Cetus hack and similar incidents serve as an important warning to the entire Web3 industry: security must be a priority at all stages of project development and operation . Only a systematic approach to security, continuous improvement of technology, and active community participation can build trust and ensure sustainable growth of decentralized finance and blockchain ecosystems in the future 1 2 3 .

Hacking in Web3 ecosystems has a significant negative impact on user trust in the security of these platforms . Despite the fundamental benefits of blockchain – transparency, decentralization, and control over one’s own data – frequent thefts and vulnerabilities highlight the risks and limit mass adoption of the technology.

How hacks affect user trust

Growing concerns about the security of assets and personal data. Users see that even large and technically advanced projects are susceptible to attacks, which reduces confidence in the reliability of Web3 products and leads to caution when investing and using services 1 4 .
Deterioration of the ecosystem’s reputation and loss of interest. Large-scale losses of funds cause panic and negative feedback, which can slow down the development and implementation of new projects, especially among less technically savvy users 2 .
Increased regulatory pressure: Frequent incidents attract the attention of government agencies, which begin to demand stricter controls and security standards, which can limit decentralization and user freedom 1 .
Highlighting vulnerabilities not only in the blockchain but also in Web2 integrations. Many attacks occur through exploits of Web2 components (e.g. frontend, tag management), which demonstrates the need for a comprehensive approach to security 5 .

Lessons and tips for increasing trust

Mandatory and regular auditing of smart contracts and infrastructure , including penetration testing and real-time monitoring, to promptly identify and fix vulnerabilities 1 3 .
Comprehensive security that covers both Web3 and Web2 layers , as attacks often exploit weaknesses in integrations and supporting services 5 .
Implementation of multi-layered security measures such as multi-signature wallets, access rights restrictions, two-factor authentication and anomaly monitoring systems 5 6 .
Transparency and openness of projects , which allows the community and “white hat” hackers to discover and report issues faster, increasing the overall level of security 6 .
Educating users and developers on cybersecurity practices and risk awareness to help reduce the number of successful attacks and fraud.

Summary and conclusion

The hack of the Cetus decentralized exchange on the Sui blockchain, which resulted in the theft of over $220 million, has become a serious test for the entire Web3 ecosystem and demonstrated how vulnerable even the most modern DeFi projects are to cyberattacks. By exploiting a vulnerability in smart contracts and pricing mechanisms, attackers were able to withdraw huge amounts of assets in minutes, highlighting the importance of comprehensive auditing and ongoing security monitoring of protocols.

While Web3 offers new opportunities for managing digital assets and data, hacks and vulnerabilities remain a major obstacle to user trust . Only a systematic and comprehensive approach to security that combines technical measures, transparency, and education can build trust and ensure the sustainability of Web3 ecosystems in the future 1 3 5 .

The response of Sui validators — promptly freezing a significant portion of the stolen funds — was an important step in preventing further losses and beginning the process of returning assets to users. However, this measure has sparked intense debate in the community, as the ability to block wallets calls into question the basic principles of decentralization and censorship resistance of the network. This trade-off between security and freedom of transactions reflects the complexity of managing modern blockchain networks, where the balance between protecting users and maintaining a decentralized structure remains a hotly debated issue.

The Cetus team, together with the Sui ecosystem, is taking comprehensive steps to restore the protocol and compensate users for their losses – from updating smart contracts and transferring frozen assets to multi-signature wallets to organizing community votes and proposing “white-hat deals” with the hackers. These efforts demonstrate the importance of coordination between developers, validators, and the community in combating the consequences of attacks and building trust.

Overall, this incident has become a wake-up call for the entire Web3 industry, highlighting the need for increased security, transparency, and user education. Only a systemic and multi-layered approach to security, consistent with the principles of decentralization, can ensure the sustainable development of decentralized finance and strengthen trust in the ecosystems of the future.

$220 Million Cetus Hack: Security Challenges, Sui Validators’ Response, and Lessons for Trust in Web3 Ecosystems

By