Author: f(gautham), co-founder of polynomial; Compiled by: AIMan @ Jinse Finance.

On May 22, 2025, a hacker stole $223 million from Sui.

Then, an unprecedented thing happened.

Sui validators effectively barred him from entering the Sui blockchain network and froze his funds during his escape.

This completely overturns our understanding of 'decentralized' blockchain.

Here is this bizarre story.

1. Hacker attack.

This hacker attack was brutal. This guy drained Cetus's liquidity pool as if it were his own home.

$223 million disappeared in a matter of hours. SUI memecoins plummeted by 75%. USDC was decoupled to zero on-chain. All swaps failed. Holders couldn't even stop loss. It was a massacre.

But things started to get interesting.

2. Hacker transferred funds.

The hacker thought he was invincible. He bridged funds to Ethereum and started exchanging them for ETH, having transferred over $60 million to Ethereum.

A typical escape route. It should have ended here. Just...

3. Sui freezes hacker's wallet.

Sui validators have other plans.

They directly banned the hacker's wallet from entering the Sui L1 network. Frozen $162 million in transactions. The remaining stolen funds? Locked in a digital prison.

No need for courts to reach a consensus. No lengthy legal procedures. Validators just need to say 'no'.

Wait, can they really do that? That’s what surprises everyone.

Indeed, Sui validators can collectively refuse transactions from specific wallets in extreme cases. This is not automatic and requires broad validator consensus. But it did happen, and in real-time.

4. The cryptocurrency world is divided.

Some say, 'If they can freeze funds, is this really decentralized?'

Some say, 'They saved $162 million from being permanently stolen.'

Both sides have valid points.

But importantly: This completely changes the assumptions about Layer-1 security.

5. Details of the hacker attack and Sui team's response.

The specific details are still unclear, and no official incident report has been received.

Known information: The hacker controlled a liquidity pool priced in SUI and systematically drained it. Cetus initially referred to it as a 'oracle exploit', but the full method of exploitation remains unclear.

Cetus's response was indeed impressive:

• Immediately suspend contracts to prevent further theft.

• Cooperate with Sui Foundation and validators.

• Tag hacker accounts across the entire ecosystem.

• Collaborate with professional anti-cybercrime organizations.

• Provide white-hat settlement terms for professional damage control.

The Sui team stated that most validators agreed to ignore any transactions from the hacker's wallet address and issued a PR requesting each validator to deploy the patch code so they could take back the $160 million the hacker stole through unsigned transactions.

6. How to evaluate.

Sui's validators coordinated very quickly. In traditional finance, freezing stolen funds takes weeks. But here? Just a few hours.

Whether you see this as a good emergency response or a centralization issue depends on your perspective.

7. Hacker's mistake.

Thinking one person could control the entire chain. His judgement about control was right, but his judgement about who has control was wrong.

It turns out the issue was not with him, but with the collective efforts of the validators.

Collective power is greater than individual attacks.

8. What’s the next step?

Cetus is negotiating with the hacker about returning the funds.

Relevant legal measures have been initiated.

A complete incident report is forthcoming.

But the real question is: Will other L1s adopt similar emergency mechanisms?