Zachxbt calls SUI for insufficient incident response infrastructure

Blockchain analyst ZachxBT has publicly criticized the security infrastructure of SUI networks and the handling of recent exploits. He says SUI’s decision to handle investigations internally has limited their ability to respond effectively and track stolen funds.

Yesterday, on June 2, SUI’s security team revealed an update on smart contract exploits affecting some Defi protocols built on SUI networks.

According to Suisecurity, the attacker exploited a vulnerability related to Deepbook, the network’s order book engine.

Related: Cetus Hack Aftermath: SUI Community Debates Frozen Funds Returns, Heighs Use user Protect

Zachxbt criticizes SUI’s response strategy

Shortly after the announcement, prominent code investigator Zachxbt responded with criticism. He argued that SUI relied on internal tools and processes delayed its ability to handle violations.

“The teams are cheap so you need to stop trying to do everything in-house,” he said in an X post.

He emphasized that SUI’s native-only tools make it difficult to track cross-chain fund movements, particularly in complex laundry scenarios involving the North Korean Lazarus Group.

It is cited as a model for improvement

ZachxBT compared the SUI handling with Aptos. This is a rival layer 1 blockchain. He said Aptos once faced similar issues but responded quickly after making public recommendations. Their rapid adoption of cross-chain monitoring tools reportedly helped freeze the massive amounts of stolen funds associated with the DPRK attack earlier this year.

“There’s no excuse for why SUI couldn’t do the same,” Zachxbt adds, suggesting that the delay is due to internal control.

Ongoing SUI Recovery Plan

Previously, SUI began voting on-chain, successfully transferring $160 million with exploited funds to multisig wallets. The funding is currently jointly managed by Cetus, Sui Foundation and Ottersec. Over 90% of validators and stakers supported this move.

Related: As SUI Community votes end, $160 million from Cetus Exploit Funds moved to Multisig

Meanwhile, Cetus has begun restoring its protocol, including upgrading contracts for liquidity market makers, asset conversions and planning compensation strategies.