---

Validators representing nearly 91% of Sui stake approved an on-chain proposal to release about $162 million seized during last week’s Cetus exploit, allowing the DEX to reimburse users and restore full operations.

Cetus said in a social media post that the 48-hour referendum closed on May 29 when more than two-thirds of the network endorsed the measure.

Cetus hack victims to be reimbursed fully

The approved transaction instructs validators to transfer the frozen tokens to a multi-signature wallet controlled by Cetus, security auditor OtterSec, and the Sui Foundation. 

The foundation confirmed the outcome and said the funds will remain in trust until Cetus executes its repayment plan. “Protocol governance is only possible through your active participation,” the foundation told stakers and node operators, crediting them for concluding the vote swiftly.

The decision resolves a key uncertainty that followed the May 22 attack, which drained an estimated $223 million in liquidity. 

Attackers bridged roughly $61 million to Ethereum before validators halted the address, leaving $162 million stranded on Sui. 

Cetus told users on May 27 that it could cover the bridged amount through its reserves and a short-term loan from the foundation, but it needed the community’s consent to unlock the frozen balance.

Roadmap for restitution and restart

Cetus outlined an eight-step recovery schedule, targeting a complete relaunch within one week. Validators will first execute the protocol upgrade, which transfers the locked assets into the tri-party wallet. 

Engineers have already completed an emergency update to the concentrated-liquidity market-maker contract and sent it for audit.

The team will then restore pool data, calculate individual liquidity deficits, and convert the retrieved tokens back to their original composition. 

Because attackers executed extensive swaps during the exploit, Cetus plans to use “minimal-impact strategies” to avoid further slippage while rebalancing pools.

Developers are creating a compensation contract that will distribute any unrecovered amounts once the auditors complete their review. 

Cetus is committed to transparent progress reports during the recovery week and stated that staff are “fully mobilized” to meet the timeline. 

Funds will be transferred to the multi-sig wallet once the validators finalize the upgrade, clearing the way for Cetus to reimburse users and bring its exchange back online.

Mentioned in this article

Blockchain analyst ZachXBT revealed that roughly $7 million of the $330 million in Bitcoin (BTC) stolen from a longtime US crypto holder has been frozen with the help of Binance.

The update comes days after ZachXBT first reported a suspicious transfer of 3,520 BTC, worth about $330 million at the time, from a single wallet.

Two suspects

On April 30, the investigator revealed that the victim is an elderly American who fell prey to a social engineering attack. The Bitcoin was quickly moved across at least six exchanges and laundered into Monero (XMR).

ZachXBT said two suspects have been identified: a Somalian national known as “Nina” or “Mo,” who allegedly runs a call scam operation in Camden, UK, and an accomplice referred to as “W0rk.”

Both individuals deleted their social media accounts after being named.

The theft relied on social engineering tactics, a form of deception that typically involves phishing or impersonation to gain access to sensitive credentials.

According to ZachXBT, the attackers operated a coordinated scheme involving fake websites and voice calls to manipulate the victim into revealing private keys or login credentials.

Binance and crypto sleuths freeze stolen funds

ZachXBT credited Binance’s security team, the pseudonymous investigator tanuki42, and Cryptoforensic Investigators with helping freeze about $7 million of the stolen funds.

Binance has not issued a formal public comment, but the platform has a history of collaborating with law enforcement and onchain analysts to intercept illicit activity.

This marks a rare instance of rapid recovery following a large-scale crypto theft. The remaining funds are believed to be more difficult to trace, having been funneled into Monero, a coin designed to obscure wallet balances and transaction history.

The $330 million theft now ranks among the largest single-wallet heists in crypto history. It has also reignited concerns about the vulnerability of early adopters who may not have updated security practices or cold storage protections.

In previous reporting, ZachXBT called the theft “deeply upsetting,” especially considering the victim’s age and status as an early supporter of the Bitcoin network. Investigations are ongoing as the crypto community and private investigators attempt to trace any further movement of the funds.

Mentioned in this article

---