The Sui blockchain just flipped the tables on a hacker who drained $223 million from Cetus, the network’s top DEX aggregator. The community voted and didn’t just patch the hole... No! They decided to strike back launched a bold, consensus-powered move to recover the stolen funds.
So yeah, the network just hacked the hacker!
First, What Happened to Cetus?
On May 22, an attacker exploited a critical vulnerability in Cetus’ smart contracts, using fake tokens to trick the protocol into thinking they were valuable. This let them drain liquidity pools like it was an all-you-can-eat buffet (and the guy was hungry).
By the time the dust settled, the attacker had already bridged about $60 million to Ethereum and crashed several Sui-based tokens in the process. Lofi dropped 76%, Hippo tanked 81%, and USDC on Sui even depegged to zero (ouch).
Validators Froze $162M on Sui
Fortunately, this wasn’t a total rug pull as Sui’s validators identified the addresses holding the stolen funds and froze $162 million before more damage could be done. Nice save!
And after came a DeDilemma (yes, I just made that word up): Do you let the funds sit frozen forever in the name of decentralization, or do you take action?
The Community Chose to Strike Back
Sui's network and their community didn’t stay on the bench for long and entered the court with immediate and huge impact. An on-chain governance vote kicked off to decide whether to forcibly unlock the attacker’s frozen funds and move them into a multi-signature wallet, acting as a shared vault controlled by Cetus, the Sui Foundation, and security firm OtterSec.
Over 90.9% of validator stake said yes, which made it a decisive win for those in favor of action.
Critics argue this kind of intervention feels a bit too centralized, but supporters see it as necessary self-defense, especially when real users and their funds are at stake.
Now, What’s Next?
With the vote passed, Cetus is working on a reimbursement timeline. All affected users will be made whole using the recovered $162M, topped off with funds from Cetus’ own treasury and a loan from the Sui Foundation.
Sui’s not stopping there. They’re also launching a $10 million initiative to fund better audits, formal verification tools, and an expanded bug bounty program. As sometimes said, once is a breach but twice is a trend, and it's always nice to see players take action to reinforce their security. In the end, it's all about offering the best service to the users, and in crypto, security is paramount.
With all that being said, this is a massive recovery! It shows that while DeFi prides itself on being “code is law,” communities still have the power to write the rules when things go off the rails.
Summary
- Hacker drained $223M from Sui-based DEX Cetus using fake tokens.
- The network's validators froze $162M of the stolen funds.
- The community voted to unlock and recover the funds as a “hack the hacker” move.
- All affected users will be fully reimbursed.
- Sui is rolling out $10M in security upgrades to prevent future attacks.
Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.