Sui Froze $162M From a Hacker — Security or Centralization?

$223 million stolen in minutes. $162 million frozen by validators before it left the network. An emergency vote where 90.9% of staked funds said "yes" to returning the funds. Sui did what no blockchain had done before: validators blocked the attacker's addresses directly on-chain and reversed the damage. Is this the security model of the future — or proof that Sui is not as decentralized as it claims?

This article analyzes the three exploits suffered by the Sui DeFi ecosystem between 2025 and 2026, why the Cetus hack sparked a debate about the limits of decentralization, and what an investor should know before depositing capital into a network where validators can freeze your funds.

What is Sui and why does its architecture matter for security?

Sui is a Layer 1 (L1 — the base network, like Ethereum or Solana) blockchain created by Mysten Labs, founded by former Meta engineers who worked on the Diem project. Its fundamental technical difference is the Move language, specifically designed to treat digital assets as "objects" with strict ownership rules verified before executing any transaction.

In practice, Move inherently eliminates reentrancy attacks (when a malicious contract repeatedly calls another before the first operation finishes) that have caused billions in losses on Ethereum. Assets cannot be accidentally duplicated, nor can dynamic calls be made during contract execution. It's a real security improvement at the language level.

But language security does not protect against errors in the financial logic of the protocols built on top — as demonstrated by the largest hack in Sui's history.

What happened with Cetus and why does it matter beyond Sui?

On May 22, 2025, Cetus Protocol — Sui's largest concentrated liquidity DEX (decentralized exchange) — was exploited for $223 million. It was not a failure of the Move language or the Sui network. It was a mathematical error in a third-party library called integer-mate, used for precision calculations.

The attacker found a flaw in the checked_shlw function (left bit shift) that did not correctly validate overflow conditions. With extreme parameters and a flash loan (a loan taken and repaid in the same transaction), they injected fake tokens into liquidity pools, artificially inflated their position, and drained real assets (SUI and USDC) from the pools.

The technical lesson: even in Move — designed to prevent low-level errors — the security of a DeFi protocol depends on every external library. A faulty rounding function nullified all language guarantees. KelpDAO suffered the same pattern in April 2026: the failure was not in the core protocol but in the peripheral infrastructure.

Did Sui validators "hack the hacker" — and is that good or bad?

Here's the real debate. When validators detected the exploit, they coordinated an emergency action: they blocked the attacker's addresses on-chain before most of the funds could be moved off Sui. $162 million were frozen. The remaining ~$63 million escaped to Ethereum via bridges before the intervention.

Three days later, on May 29, Sui executed an on-chain vote to decide whether to return the frozen funds to the victims. 90.9% of the stake voted yes. The funds were transferred to a multisig controlled by Cetus, the Sui Foundation, and OtterSec (auditor). Cetus supplemented with its treasury ($7M) and a $30M loan from the Sui Foundation to compensate victims 100%.

The argument in favor: $162 million recovered. Victims 100% compensated. Response in days, not months. On Ethereum, Lazarus laundered $577M without anyone being able to freeze anything. On Sui, the network acted.

The argument against: if validators can freeze a hacker's addresses, they can also freeze yours. The action was coordinated by the Sui Foundation — not by a decentralized DAO with a formal process. Who decides when freezing is legitimate and when it is censorship? What happens when a government requests the same action against a dissident instead of a hacker?

The comparison with the general debate on centralization in DeFi is direct:

Sui has a Nakamoto coefficient of 20 — more decentralized than BNB Chain (5) or Polygon (4), comparable to Solana (21), but well below Polkadot (92). The 117 validators are enough to coordinate an emergency freeze in hours. Ethereum, with a million validators, does not have an equivalent mechanism — which protects against censorship but leaves hack victims without on-chain recourse. There is no right answer: it's a trade-off between recoverable security and censorship resistance.

A detail that amplifies the debate: the Sui Foundation controls a significant portion of the SUI supply. Critics point out that the founders control a high percentage of the total supply (including locked tokens), which grants disproportionate influence over governance. The Foundation has responded that its goal is to progressively distribute delegation — but the current power is undeniable.

What other exploits has Sui suffered in 2026?

Cetus was not an isolated incident. The Sui DeFi ecosystem has suffered three additional exploits, each with a different pattern:

The patterns reveal an evolution: Cetus was a mathematical error in a library (sophisticated). Nemo was weak governance — unaudited code deployed with a single authorization signature. Volo was a compromised private key (the most basic and hardest-to-prevent vector). Scallop was a flash loan in a peripheral contract.

The positive trend: none of the exploits after Cetus compromised Sui's core or the Move language. The attack surface has shifted to the application layer — admin keys, peripheral contracts, external libraries. The negative: $229M in total losses for an ecosystem with $1.6B TVL is a loss ratio of 14% — significantly worse than the industry average.

Is Move really more secure than Solidity?

Move eliminates entire categories of vulnerabilities that have cost billions on Ethereum. Reentrancy — responsible for hacks like The DAO ($60M, 2016) or Euler ($197M, 2023) — is impossible by design in Move. But language security does not prevent errors in financial logic, external libraries, or key management.

Sui's bytecode verifier — which analyzes all code before execution — is so critical that the bug bounty program classifies any bypass as maximum severity (reward up to $1M). And tools like Belobog (a Move-specific fuzzer) retroactively detected 100% of Cetus and Nemo vulnerabilities in tests on 109 real projects.

Is Sui safe for depositing capital in DeFi?

It depends on which layer and what you mean by "safe":

The ability of validators to freeze funds is a double-edged sword: it saved $162M in Cetus, but it means your capital is not immune to intervention. If you value censorship resistance above all else, Sui is not your network. If you value the ability to recover from hacks, Sui proved it works.

Is Sui still growing despite the hacks?

Yes — and that's the most revealing part. After the Cetus hack ($223M in May 2025), Sui's TVL briefly dropped but recovered in weeks. Protocols like NAVI reopened with 25% APYs to attract liquidity. In March 2026, Sui launched USDsui — its native stablecoin for payments and DeFi. Flare and Xaman integrated DeFi access for over 2 billion XRP tokenized as FXRP. And Sui invested $10M in a security program after the Cetus hack.

Current numbers show an ecosystem growing with scars:

The 14.3% losses/TVL ratio is high compared to the industry average. But the ability to recover $162M out of $223M stolen (73%) is unprecedented — no other network has achieved anything comparable. The question for the investor is not whether Sui is safe in the abstract — it's whether the combination of Move + validators with freezing power + a young ecosystem outweighs the risk compared to more mature alternatives like Ethereum or Solana.

What should an investor verify before using DeFi on Sui?

1. Does the protocol use multisig for updates? Nemo was exploited because a single signature could deploy code. Volo was drained by a compromised admin key. If the protocol doesn't use multisig, your capital depends on a single person.
2. Are external libraries audited? Cetus used a third-party library (integer-mate) with an overflow error. Audits of the main contract do not cover dependencies — ask if they do.
3. Is the contract immutable or upgradeable? Move packages on Sui are immutable once published — but protocols can use proxy or migration patterns. Verify if the protocol can change logic after deployment.
4. How much of the TVL is in the protocol vs. the network? If a single protocol concentrates more than 30% of Sui's TVL, an exploit in that protocol is a systemic event for the entire network — as Cetus demonstrated.
5. Are you comfortable with Sui's governance? Validators can freeze addresses. The Sui Foundation has significant influence. It's "safer" than Ethereum in a hack — but less censorship-resistant.

The most honest thing to say: Sui has a superior security architecture at the language level (Move > Solidity for preventing low-level vulnerabilities), an unprecedented ability to respond to hacks ($162M recovered), and a young DeFi ecosystem that still makes governance and key management mistakes. The network is solid. The protocols built on top are not always. And the ability of validators to intervene is a feature that can be a virtue or a flaw — depending on whether you are on the side of the victim or the censored.