Conclusion first, I have never been more confident than ever in Sui community after this incident. Shit always happens, but what we can do is to fix the problem calmly and swiftly to minimize harm and bring everyone together. Not only the
@CetusProtocol team and
@Mysten_Labs @SuiFoundation handled it proficiently, but we see support from entire community. Whatever doesn't kill you makes you stronger!
Appreciation aside, let's dive into some common questions.
- How was Cetus hacked? Is Sui still a safe blockchain?
The attack resulted from a flaw in the smart contract logic. The check function failed to detect an overflow when casting u256 to u64, enabling the minting of substantial liquidity with a minimal token amount.
@neeksec posted detailed threads explaining how the hacker attacked the smart contract and pointed out that Move will natively abort if the cast result is too large to represent as u64.
nitter.app/neeksec/status/1925558…
The fundamental infrastructure of the Sui blockchain wasn't attacked; Sui remains robust and secure. However, this incident reveals the risk of manual mistakes at the application layer. That's why I'm looking forward to seeing Sui introduce Bugdar, an AI-powered smart contract auditing tool to detect potential vulnerabilities.
- How did Sui freeze the hacker's money? Is Sui a decentralized blockchain?
This question is what people care about the most. The hacker's money is frozen in the wallet and unable to transfer or supply any transaction because the validators voted not to record any transaction made from the hacker's address, thus the money is "locked" in the wallet and can't be transferred.
This is the consensus of validators; with the validators collaborating together, the money can be frozen. If there weren't enough validators to agree to blacklist the hacker's wallet, the funds would have already been gone.
I know this still sounds very "centralized". Well, we have to admit that the remaining governance mechanism, either in the real world or web 3 community, is based on majority decision or consensus, which is to protect most people's benefit.
The current situation leaves everyone in limbo. The funds are frozen, but this standoff benefits no one. To the hacker: you have the power to end this gracefully. By voluntarily returning the funds, you not only do the right thing but also demonstrate that the crypto space can self-regulate through individual conscience, not just technical enforcement. This would be a powerful statement about the future of decentralized systems.
To be honest, nothing can work smoothly under an extreme condition - extreme decentralization, extreme centralization, complete democracy. Things work under a balanced condition, balancing between centralization and decentralization, within the core value of defending justice. There's no doubt that the hacker's attack is a malicious action, and what the Cetus team, Sui Foundation and Mysten Labs have done is to minimize the harm with reasonable means.
Some argue that freezing funds violates decentralization. But let’s be real—a system with no rules isn’t decentralized, it’s lawless. If we lived in a society with total freedom—where anyone could steal, rob, or murder without consequence—would that be justice? Of course not. That’s anarchy. That’s why we have laws.
Blockchain governance should serve a similar role: a system of "on-chain laws" that enable fair, collective protection. This validator consensus is like a legal system on-chain—a mechanism that doesn’t depend on any single actor, but still allows the network to act against malicious behavior.
It’s not perfect. But it’s a more realistic and responsible version of decentralization, especially if we want mass adoption and institutional trust.
We've shown that the Sui ecosystem can respond to crises with unity and technical competence. Now it's time for the individual who caused this crisis to show equal maturity. The crypto world is watching—not just how our technology responds to attacks, but how our community handles moral challenges. You have an opportunity to be remembered not as someone who exploited a vulnerability, but as someone who ultimately chose to do right by the community.
Finally, I would like to shout out to
@lofitheyeti and
@eyezenhour who hosted the Twitter Space right after this incident happened, and
@EmanAbio was on the frontier bringing the latest updates to the audience. It really helped bring the community together, stop the FUD and panic, and give a lot of support to the people affected by this incident.
This is why I'm so bullish on Sui, together we strong.