Validators representing nearly 91% of Sui stake approved an on-chain proposal to release about $162 million seized during last week’s Cetus exploit, allowing the DEX to reimburse users and restore full operations.

Cetus said in a social media post that the 48-hour referendum closed on May 29 when more than two-thirds of the network endorsed the measure.

Cetus hack victims to be reimbursed fully

The approved transaction instructs validators to transfer the frozen tokens to a multi-signature wallet controlled by Cetus, security auditor OtterSec, and the Sui Foundation. 

The foundation confirmed the outcome and said the funds will remain in trust until Cetus executes its repayment plan. “Protocol governance is only possible through your active participation,” the foundation told stakers and node operators, crediting them for concluding the vote swiftly.

The decision resolves a key uncertainty that followed the May 22 attack, which drained an estimated $223 million in liquidity. 

Attackers bridged roughly $61 million to Ethereum before validators halted the address, leaving $162 million stranded on Sui. 

Cetus told users on May 27 that it could cover the bridged amount through its reserves and a short-term loan from the foundation, but it needed the community’s consent to unlock the frozen balance.

Roadmap for restitution and restart

Cetus outlined an eight-step recovery schedule, targeting a complete relaunch within one week. Validators will first execute the protocol upgrade, which transfers the locked assets into the tri-party wallet. 

Engineers have already completed an emergency update to the concentrated-liquidity market-maker contract and sent it for audit.

The team will then restore pool data, calculate individual liquidity deficits, and convert the retrieved tokens back to their original composition. 

Because attackers executed extensive swaps during the exploit, Cetus plans to use “minimal-impact strategies” to avoid further slippage while rebalancing pools.

Developers are creating a compensation contract that will distribute any unrecovered amounts once the auditors complete their review. 

Cetus is committed to transparent progress reports during the recovery week and stated that staff are “fully mobilized” to meet the timeline. 

Funds will be transferred to the multi-sig wallet once the validators finalize the upgrade, clearing the way for Cetus to reimburse users and bring its exchange back online.

Mentioned in this article

Sui-based protocol Cetus said on May 27 that it can reimburse every user affected by its May 22 exploit if Sui token holders approve the return of frozen funds in an upcoming on-chain vote.

Cetus said in a May 27 social media post that its cash and token reserves, combined with a secured loan from the Sui Foundation, are enough to cover the $61 million in assets the attacker bridged to Ethereum.

According to a May 27 post by Sui, the loan applies only to the amount bridged outside Sui, not to the remaining $162 million that validators have already frozen on the network.

An upcoming community vote will decide whether to unlock the tokens that were frozen by validators after the exploit.

The DEX has asked the Sui community “for full support” to ensure it can make the affected users whole. Cetus also said it would publish a step-by-step repayment plan regardless of the vote’s outcome.

The Cetus exploit is the ninth-largest hack in the crypto industry in terms of the amount stolen, according to the Rekt News leaderboard. 

Full recovery possible

The Sui Foundation confirmed the arrangement in a separate post, describing the loan as an “extraordinary measure” designed to restore user balances beyond what Cetus could fund alone.

Sui Foundation officials stated that the community vote proposal will appear on-chain “shortly” and that validators remain ready to move the frozen tokens if holders approve.

Furthermore, Foundation executives added that the loan proceeds are in escrow, and deployment could occur as soon as the smart contract community concludes the proposal.

Cetus paused all contracts on May 22 after an attacker exploited a flaw in the protocol’s pricing logic. 

On-chain data indicates that the breach resulted in $223 million worth of tokens, with $61 million transferred to Ethereum and $162 million halted by Sui validators.

Cetus contacted the exploiter through on-chain messages, offering a $6 million bounty in exchange for the funds bridged to Ethereum. However, the protocol did not receive a reply.

Project developers said they “deeply regret the impact” and will “begin recovery immediately” once they finalize the mechanics for distributing reimbursements. 

Cetus reiterated that rebuilding user trust remains its top priority and is committed to providing periodic progress updates. The protocol has not disclosed a timeline for code fixes or the resumption of trading.

Mentioned in this article

Cetus Protocol posted a $5 million reward on May 23 for information that identifies and leads to the arrest of the attacker who extracted $223 million from its decentralized exchange on the Sui network. 

Announced on May 23, the offer is coordinated with cybersecurity firm Inca Digital and will be funded by the Sui Foundation if the tip proves decisive.

Informants must email the perpetrator’s name, location, and supporting proof with the subject “Cetus lead.” The DEX added that it would withdraw any civil action and cancel the bounty should the exploiter return the assets and accept the earlier settlement proposal.

Notably, the offer comes amid centralization concerns regarding Sui following the freezing of $162 million by many of its 114 validators.

Whitehat offer sets the stage

Hours before the public bounty, Cetus used an on-chain transaction to deliver a separate proposal to the attacker on Sui and Ethereum (ETH) blockchains. 

That note offered a $6 million retention fee, equivalent to 2,324 ETH, in exchange for the return of 20,920 ETH and all frozen amounts on Sui. 

The team said it had mapped the exploiter’s Ethereum wallets and was coordinating with US federal authorities, FinCEN, the Seychelles Police Force, selected defense-sector partners, major exchanges, and bridge operators. 

The ultimatum warned that any attempt to launder funds would trigger a global law-enforcement escalation.

Per the protocol’s May 22 incident disclosure on X, the attacker targeted a flaw in Cetus’ pricing mechanism, prompting an immediate pause of all smart-contract activity. The project’s blockchain data shows that the exploit yielded $223 million in tokens. 

Of that sum, $61 million was moved to Ethereum via bridges, while the remaining $162 million was frozen by Sui network validators.

Cetus has not revealed when normal trading will resume or whether the team will implement code changes before reactivating the contracts.

Validator action sparks decentralization debate

According to its block explorer, Sui hosts 114 active validators. On May 22, Sui stated that a broad plurality agreed to reject any transaction originating from the attacker’s wallets shortly after the breach.

The collective freeze prevented the remaining $162 million transfer and locked the tokens on-chain. 

Gautham Santhosh, co-founder of Polynomialfi, wrote on X that the crypto community is now weighing the benefit of rapid asset protection against the implication that validators can suspend specific accounts at will.

Although he highlighted that the process demanded consensus and was not arbitrary, the episode has changed the security assumptions regarding layer-1 blockchains.

Mentioned in this article