Preface

Cryptocurrencies are supposed to be free from centralized control—money that no one can freeze or control.

Last week, Sui's Cetus protocol suffered a $223 million attack, and the team urgently froze $162 million in funds. However, this also sparked a fierce debate: If a blockchain can suspend your funds, is cryptocurrency truly unstoppable as it claims?

Here is the timeline of the latest "decentralization" drama in the cryptocurrency world:

• How fake tokens evaporated $223 million in ten minutes

• The controversial fund freeze: Saved users but sparked outrage

• Why this team's second major hack feels all too familiar

• Sui's $10 million security overhaul (and why it might not be enough)

A Ten-Minute Collapse

May 22 seemed like an ordinary day for Sui, until things went awry. In a matter of minutes, chaos ensued.

Cetus protocol, the largest decentralized exchange under Sui with a daily trading volume exceeding $200 million, was hacked for $223 million. The attack was astonishingly efficient.

Disaster struck in an instant:

• The main meme coins on the SUI chain, LOFI, HIPPO, and SQUIRT, plummeted by over 75% within an hour.

• The native token of Cetus protocol, $CETUS, dropped by 53% over the past four days.

Source: TradingView

The attack method? Simple yet deadly.

Hackers deployed fake tokens to Cetus (essentially digital versions of "Monopoly" game currency) and exploited a vulnerability in the Cetus smart contract, tricking the protocol into thinking these worthless tokens had real value.

In short, "Imagine going to a toy exchange and bringing some toys that seem valuable but are actually worthless, then swapping them for real toys and fleeing," explained Manan Vora, head of the cryptocurrency custody company Liminal.

Centralized Freeze

The story takes a controversial turn here.

Within hours, Sui's 114 validator nodes—nodes that run the network—collectively decided to freeze the hacker's address. No voting. No governance proposal. Just like any centralized institution making a governance decision. Do you see the irony?

The result? $162 million was saved. But at what cost? It angered all proponents of decentralization.

Justin Bons from the European cryptocurrency fund Cyber Capital led the opposition to this move.

Source: Twitter user - Justin_Bons

The data reveals a harsh reality:

• Sui's validator nodes: 114

• Ethereum's validator nodes: Over 1 million

• Solana's validator nodes: 1,153

When 114 entities can coordinate to freeze funds, even for legitimate reasons, it raises unsettling questions about the true meaning of "decentralization."

A Familiar Defense

This is not the first time Cetus has been in this kind of situation—and it's not a compliment.

The same team had operated Crema Finance on Solana, which was hacked for $9 million in July 2022. And their response? They offered the hacker $1.6 million to return the funds. The hacker eventually accepted the deal but was reportedly arrested (the case details match, but have never been officially confirmed).

Now, facing a hack 25 times larger than before, the Cetus team resorted to the same tactic, proposing a time-limited settlement:

• Proposal: Return $217 million and keep $6 million

• Terms: No prosecution, no questions asked

• Deadline: 48 hours, or "legal action will be taken"

However, the crypto community was not convinced. One user summed it up: "The same team, the same vulnerability, different blockchain. How many more chances do they get?"

Crisis Control Mode

After the dust settled, the data painted a grim picture:

• Total Value Locked (TVL): Dropped from $2.1 billion to $1.7 billion (a 20% decline)

• SUI token: Declined by about 15%

• Trading volume: Complete collapse across all Sui decentralized exchanges

• User confidence: Comments on Twitter were merciless

Source: DefiLlama

Sui's response came in two parts.

First, they pledged to invest $10 million in a comprehensive security overhaul:

• Enhanced smart contract audits

• Increased bug bounty programs

• Introduction of formal verification tools

• Developer security training

• Open-source security libraries

Second, they announced a shift from "platform responsibility" to "shared responsibility." In other words: We can't take everything on ourselves; developers must also bear responsibility.

Noble? Yes. Enough? The market has already given its answer.

On Monday, the CETUS token rebounded by 10%, turning a complete collapse into just a severe blow. But the technical challenges run much deeper than price issues.

This attack exposed fundamental problems:

• Insufficient liquidity: Price volatility is inevitable

• Oracle vulnerabilities: The "culprit" that triggered everything

• Cross-chain risks: Once funds flow into Ethereum, it's game over

Now that Cetus has patched the immediate vulnerabilities, restoring confidence is not as easy as fixing code.

So what's their next move?

Our Perspective

This hack is not just about the stolen funds; it's a crisis of identity for cryptocurrency.

The Decentralization Paradox: Sui's validator nodes coordinated to save $162 million, proving the system's effectiveness. However, it also proved that 114 entities can effectively control an ecosystem network that is supposed to be decentralized. This is not the censorship-resistant freedom dreamed of by Satoshi Nakamoto or any decentralization advocate. Instead, it feels more like a community patrol with nuclear weapons. Effective? Yes. Decentralized? This is becoming a relative concept.

Capability Questioning: When the same team suffers two major hacks due to similar attack methods, it's no longer just bad luck; it's a pattern. The crypto industry has always been lenient with technical mistakes, but Cetus is pushing the limits of this tolerance. Their $6 million bounty might recover the funds, but it can't restore their reputation. At some point, the "we'll do better next time" excuse will no longer be accepted.

Maturity Test: Sui's commitment to invest $10 million in security improvements and adopt a "shared responsibility" model shows potential for growth. But it's reactive, not proactive. What's important is whether the blockchain network can mature quickly enough to handle institutional funds. With the decline in total value locked and shaken trust, Sui is no longer just fighting technical vulnerabilities; they are also battling for their place in the increasingly competitive L1 landscape.

This hack has exposed an unsettling truth: Perfect decentralization may not be compatible with user protection. Sui chose protection. Ethereum ultimately chose purity. And Bitcoin never had to make a choice.

Sui is now facing a critical decision: whether to conduct an on-chain vote to return the frozen funds. If this sounds familiar, it's because Ethereum faced the same choice after the 2016 DAO hack. Their fork decision still divides the community to this day.

Meanwhile, hackers are still controlling over $60 million on Ethereum. The deadline for Cetus' bounty is approaching. Will they take the $6 million and run, or risk everything?

The industry is watching Sui's next move. For now, the extremists of "code is law" are losing to the pragmatists who say "users want their money back."

Preface

Cryptocurrencies are supposed to be free from centralized control—money that no one can freeze or control.

Last week, Sui's Cetus protocol suffered a $223 million attack, and the team urgently froze $162 million in funds. However, this also sparked a fierce debate: If a blockchain can suspend your funds, is cryptocurrency truly unstoppable as it claims?

Here is the timeline of the latest "decentralization" drama in the cryptocurrency world:

• How fake tokens evaporated $223 million in ten minutes

• The controversial fund freeze: Saved users but sparked outrage

• Why this team's second major hack feels all too familiar

• Sui's $10 million security overhaul (and why it might not be enough)

A Ten-Minute Collapse

May 22 seemed like an ordinary day for Sui, until things went awry. In a matter of minutes, chaos ensued.

Cetus protocol, the largest decentralized exchange under Sui with a daily trading volume exceeding $200 million, was hacked for $223 million. The attack was astonishingly efficient.

Disaster struck in an instant:

• The main meme coins on the SUI chain, LOFI, HIPPO, and SQUIRT, plummeted by over 75% within an hour.

• The native token of Cetus protocol, $CETUS, dropped by 53% over the past four days.

Source: TradingView

The attack method? Simple yet deadly.

Hackers deployed fake tokens to Cetus (essentially digital versions of "Monopoly" game currency) and exploited a vulnerability in the Cetus smart contract, tricking the protocol into thinking these worthless tokens had real value.

In short, "Imagine going to a toy exchange and bringing some toys that seem valuable but are actually worthless, then swapping them for real toys and fleeing," explained Manan Vora, head of the cryptocurrency custody company Liminal.

Centralized Freeze

The story takes a controversial turn here.

Within hours, Sui's 114 validator nodes—nodes that run the network—collectively decided to freeze the hacker's address. No voting. No governance proposal. Just like any centralized institution making a governance decision. Do you see the irony?

The result? $162 million was saved. But at what cost? It angered all proponents of decentralization.

Justin Bons from the European cryptocurrency fund Cyber Capital led the opposition to this move.

Source: Twitter user - Justin_Bons

The data reveals a harsh reality:

• Sui's validator nodes: 114

• Ethereum's validator nodes: Over 1 million

• Solana's validator nodes: 1,153

When 114 entities can coordinate to freeze funds, even for legitimate reasons, it raises unsettling questions about the true meaning of "decentralization."

A Familiar Defense

This is not the first time Cetus has been in this kind of situation—and it's not a compliment.

The same team had operated Crema Finance on Solana, which was hacked for $9 million in July 2022. And their response? They offered the hacker $1.6 million to return the funds. The hacker eventually accepted the deal but was reportedly arrested (the case details match, but have never been officially confirmed).

Now, facing a hack 25 times larger than before, the Cetus team resorted to the same tactic, proposing a time-limited settlement:

• Proposal: Return $217 million and keep $6 million

• Terms: No prosecution, no questions asked

• Deadline: 48 hours, or "legal action will be taken"

However, the crypto community was not convinced. One user summed it up: "The same team, the same vulnerability, different blockchain. How many more chances do they get?"

Crisis Control Mode

After the dust settled, the data painted a grim picture:

• Total Value Locked (TVL): Dropped from $2.1 billion to $1.7 billion (a 20% decline)

• SUI token: Declined by about 15%

• Trading volume: Complete collapse across all Sui decentralized exchanges

• User confidence: Comments on Twitter were merciless

Source: DefiLlama

Sui's response came in two parts.

First, they pledged to invest $10 million in a comprehensive security overhaul:

• Enhanced smart contract audits

• Increased bug bounty programs

• Introduction of formal verification tools

• Developer security training

• Open-source security libraries

Second, they announced a shift from "platform responsibility" to "shared responsibility." In other words: We can't take everything on ourselves; developers must also bear responsibility.

Noble? Yes. Enough? The market has already given its answer.

On Monday, the CETUS token rebounded by 10%, turning a complete collapse into just a severe blow. But the technical challenges run much deeper than price issues.

This attack exposed fundamental problems:

• Insufficient liquidity: Price volatility is inevitable

• Oracle vulnerabilities: The "culprit" that triggered everything

• Cross-chain risks: Once funds flow into Ethereum, it's game over

Now that Cetus has patched the immediate vulnerabilities, restoring confidence is not as easy as fixing code.

So what's their next move?

Our Perspective

This hack is not just about the stolen funds; it's a crisis of identity for cryptocurrency.

The Decentralization Paradox: Sui's validator nodes coordinated to save $162 million, proving the system's effectiveness. However, it also proved that 114 entities can effectively control an ecosystem network that is supposed to be decentralized. This is not the censorship-resistant freedom dreamed of by Satoshi Nakamoto or any decentralization advocate. Instead, it feels more like a community patrol with nuclear weapons. Effective? Yes. Decentralized? This is becoming a relative concept.

Capability Questioning: When the same team suffers two major hacks due to similar attack methods, it's no longer just bad luck; it's a pattern. The crypto industry has always been lenient with technical mistakes, but Cetus is pushing the limits of this tolerance. Their $6 million bounty might recover the funds, but it can't restore their reputation. At some point, the "we'll do better next time" excuse will no longer be accepted.

Maturity Test: Sui's commitment to invest $10 million in security improvements and adopt a "shared responsibility" model shows potential for growth. But it's reactive, not proactive. What's important is whether the blockchain network can mature quickly enough to handle institutional funds. With the decline in total value locked and shaken trust, Sui is no longer just fighting technical vulnerabilities; they are also battling for their place in the increasingly competitive L1 landscape.

This hack has exposed an unsettling truth: Perfect decentralization may not be compatible with user protection. Sui chose protection. Ethereum ultimately chose purity. And Bitcoin never had to make a choice.

Sui is now facing a critical decision: whether to conduct an on-chain vote to return the frozen funds. If this sounds familiar, it's because Ethereum faced the same choice after the 2016 DAO hack. Their fork decision still divides the community to this day.

Meanwhile, hackers are still controlling over $60 million on Ethereum. The deadline for Cetus' bounty is approaching. Will they take the $6 million and run, or risk everything?

The industry is watching Sui's next move. For now, the extremists of "code is law" are losing to the pragmatists who say "users want their money back."