Did Cetus really "recover" $160 million in stolen funds?
TechFlow Selected TechFlow Selected
Did Cetus really "recover" $160 million in stolen funds?
Whether this fund can be recovered to compensate affected users remains unknown.
Navigating Web3 tides with focused insightsWritten by: Alex Liu, Foresight News
Yesterday, Cetus, the largest decentralized AMM exchange in the Sui ecosystem, was exploited due to a code issue involving numerical precision, allowing an attacker to fabricate liquidity and steal over $200 million.
About two hours after the theft, Cetus announced: "To date, we have confirmed that an attacker has stolen approximately $223 million from the Cetus protocol. The team has taken action to lock the contracts to prevent further fund theft and has frozen $162 million of the stolen funds. We are currently working with the Sui Foundation and other ecosystem members to develop next steps, aiming to recover the remaining stolen assets. Most of the affected funds have been suspended from use, and we are actively exploring ways to restore the remaining funds. A full incident report will be released later."
It is important to note that the term used here is "frozen" rather than "recovered." This means whether these funds can eventually be returned to compensate affected users remains uncertain. The official Sui team provided a more detailed explanation of this process.
Aside from the funds the hacker bridged to the Ethereum mainnet and exchanged for over 20,000 ETH (approximately $60 million), most of the stolen assets remain in the hacker’s Sui chain address. The so-called "freezing" of these assets essentially means Sui validators have collectively agreed to "censor" the relevant addresses—effectively agreeing to ignore them.
Objectively speaking, this violates the principle of "censorship resistance" in the decentralized world and represents a centralized operation, sparking significant controversy within the community.
Then how can these funds be retrieved after being "frozen"? A Sui co-founder mentioned returning the recovered funds back into Cetus liquidity pools, assuming the recovery is successful.
In simple terms: "Freezing" renders the hacker’s signatures on the Sui chain invalid, preventing transactions from being confirmed and trapping the funds in the address. However, "recovery" would require transferring the assets out of the hacker’s address without their signature. Is this even possible?
In fact, Chaofan, an engineer at Solayer, stated that the Sui team has already requested every validator on Sui to deploy a patch code to enable them to "recover" the funds even without the attacker's signature. This is clearly a centralized move, triggering even greater debate in the community—that assets could be forcibly transferred from an address without its owner’s consent.
(Note: Some Sui validators responded that they did not receive any such "request," and Chaofan later clarified that no Sui validators have currently deployed the related code.)
However, this is clearly an exceptional and不得已 measure, indicating that Sui’s decentralization includes an emergency "switch." The reason Sui can do this lies in its relatively small number of validators—just over 100—and the fact that most are institutions closely aligned with the Sui Foundation, making coordination easier. (Sui validators must either own or attract staking of over ten million SUI tokens, a requirement typically only large institutions can meet.)
The author supports this approach. Cetus is the largest decentralized AMM exchange on Sui, and its liquidity pools contain countless people’s savings and livelihood funds. Moreover, many Sui-based project tokens rely primarily on Cetus for liquidity; losing this liquidity would be devastating for these ecosystem projects. Recovering these funds is essential to protect Sui’s DeFi ecosystem, which was thriving but still far from mature.
If one insists on adhering strictly to the dogma of "decentralization" at the cost of destroying all this, it would resemble those who, after Ethereum’s DAO hard fork, chose to remain with ETC (Ethereum Classic) as purists. The author agrees with the following view: Decentralization is a goal, not a starting point. At this stage, if I sought ultimate decentralization, I would choose Ethereum. But now, I am glad that Sui is taking steps to help recover funds for users harmed in the Cetus incident.
Reflections on the incident by the founder of Bucket Protocol on Sui
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
Foresight News
