Author: f(gautham), co-founder of polynomial; Translated by: AIMan@Jinse Finance

On May 22, 2025, a hacker stole $223 million from Sui.

Then, something unprecedented happened.

The Sui validators actually banned him from entering the Sui blockchain network and froze his funds during his escape.

This completely upends our understanding of 'decentralized' blockchains.

Here is this bizarre story.

1. Hacker attack

This hacker attack was very brutal. This guy drained Cetus's liquidity pool as if it were his own home.

$223 million disappeared within hours. SUI memecoins plummeted by 75%. USDC was decoupled to zero on-chain. All swaps failed. Holders couldn't even stop losses. It was a massacre.

But things started to get interesting.

2. Hacker transferred funds

The hacker thought he was unstoppable. He bridged funds to Ethereum and started exchanging for ETH, transferring over $60 million to Ethereum.

Typical escape route. It should have ended here. Just...

3. Sui freezes hacker's wallet

Sui validators have other plans.

They directly banned the hacker's wallet from entering the Sui L1 network. They froze $162 million in transactions. The remaining stolen funds? Locked in a digital prison.

No need for a court consensus. No lengthy legal procedures. Validators just need to say 'no'.

Wait, can they really do that? That's the surprising part for everyone.

That's right, Sui validators can collectively refuse transactions from specific wallets in extreme cases. This isn't automatic and requires broad validator consensus. But it did happen, and in real-time.

4. The cryptocurrency world is divided

Some say, 'If they can freeze funds, is this really decentralized?'

Some say, 'They saved $162 million from being permanently stolen.'

Both sides have reasonable and well-supported viewpoints.

But the important thing is: this completely changes the assumptions about Layer-1 security.

5. Details of the hacker attack and Sui team's response

The specific details are still unclear, and no official event report has been received.

Known information: The hacker controlled a liquidity pool priced in SUI and systematically drained it. Cetus initially referred to it as a 'oracle exploit', but the full method of exploitation remains unclear.

Cetus's reaction is indeed impressive:

• Immediately suspend contracts to prevent further theft

• Collaborate with the Sui Foundation and validators

• Tag hacker accounts across the entire ecosystem

• Collaborate with professional cybercrime organizations

• Provide white-hat settlement terms and professional damage control.

The Sui team stated that most validators agreed to ignore any transactions from the hacker's wallet address and issued a PR requesting every validator to deploy patch code so they could reclaim the $160 million stolen by the hacker via unsigned transactions.

6. How to evaluate

The coordination speed of Sui validators is very fast. In traditional finance, freezing stolen funds takes weeks. But here? Just a few hours.

Whether you think this is a good emergency response or a centralization issue depends on your perspective.

7. Hacker's mistake

Thought one person could control the entire chain. He was right about the control, but wrong about who held the control.

It turns out the problem wasn't with him, but with the collective efforts of the validators.

Collective power is greater than individual attacks.

8. What’s the next step?

Cetus is negotiating with the hacker regarding the return of funds.

Relevant legal measures have been initiated.

A complete event report is forthcoming.

But the real question is: will other L1s adopt similar emergency mechanisms?