Verify a decision

{"actor":"system:backfill","investigation_id":"5d6a6e3d-9ec3-45e6-8461-82efc3ea7707","kind":"publish","page_slug":"sui","published_at":"2026-05-16T03:07:54.110Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sui","sections":[{"content":"On May 22, 2025, Cetus Protocol — the largest decentralized exchange and liquidity provider on the Sui blockchain — was exploited for approximately $223 million, making it the second-largest DeFi hack of 2025, behind only the $1.46 billion Bybit breach. The attack began at approximately 10:30 UTC. The root cause was a faulty overflow check in the checked_shlw function inside the integer-mate u256 math library. The vulnerable code compared a value against an incorrect threshold before performing a 64-bit left-shift, allowing unsafe intermediate values to pass the overflow guard. This corrupted the fixed-point liquidity-delta calculation in Cetus's Concentrated Liquidity Market Maker (CLMM) contract. By exploiting the bug, the attacker could credit themselves with vastly inflated liquidity for a negligible deposit, then withdraw full reserves from 46 affected liquidity pools. Flash loans were used to source temporary balances. Approximately $60 million was bridged from Sui to Ethereum through Wormhole, Circle CCTP, Sui Bridge, and Mayan before intervention was possible. The attacker's primary Ethereum address 0x89012a55cd6b88e407c9d4ae9b3425f55924919b received bridged funds, with approximately $53 million subsequently moved to 0x0251536bfcf144b88e1afa8fe60184ffdb4caf16. On Sui, the attacker's wallets — including 0xcdb8962dad278d8b50fa0fe1eb0186bf4cbdecc6d59377214c88d0286a0ac9562 — held approximately $162 million that was frozen via validator intervention. Affected tokens including CETUS dropped more than 40%, with some pool tokens collapsing by up to 99%. The SUI token price fell approximately 15% in the days following the exploit. Security firm Elliptic tracked the cross-chain laundering route and made exploit-associated addresses available for screening across virtual asset service providers.","heading":"Cetus Protocol Exploit — $223 Million Hack (May 2025)","severity":"critical","sources":[{"credibility":2,"name":"Inside The $223M Cetus Exploit: Root Cause And Impact Analysis — Cyfrin","type":"research","url":"https://www.cyfrin.io/blog/inside-the-223m-cetus-exploit-root-cause-and-impact-analysis"},{"credibility":2,"name":"Cetus Protocol hacked for more than $200 million — Elliptic","type":"research","url":"https://www.elliptic.co/blog/cetus-protocol-hacked-for-more-than-200-million"},{"credibility":2,"name":"Explained: The Cetus Hack (May 2025) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-cetus-hack-may-2025"},{"credibility":2,"name":"$223 Million Stolen in Cetus Protocol Hack — SecurityWeek","type":"news","url":"https://www.securityweek.com/223-million-stolen-in-cetus-protocol-hack/"},{"credibility":1,"name":"Cetus, Sui Network's Biggest DEX and Liquidity Provider, Loses $260M in Hack — CoinDesk","type":"news","url":"https://www.coindesk.com/markets/2025/05/22/sui-networks-cetus-protocol-hit-in-apparent-hack-sending-token-prices-down-90"},{"credibility":2,"name":"How $220M was stolen in minutes: Understanding the Cetus DEX exploit on Sui — CoinTelegraph","type":"news","url":"https://cointelegraph.com/explained/how-220m-was-stolen-in-minutes-understanding-the-cetus-dex-exploit-on-sui"}]},{"content":"Following the Cetus exploit, Sui validators coordinated an emergency freeze of approximately $162 million in attacker-controlled addresses on-chain. The freeze was executed through individual validator configuration files that allow nodes to exclude specific addresses from transaction processing — a mechanism that does not require a protocol-level upgrade but relies on out-of-band coordination among validators. Sui subsequently initiated a formal on-chain community vote on whether validators should execute a smart contract upgrade that would forcibly transfer the frozen funds to a multi-signature trust wallet controlled by Cetus and the Sui Foundation for victim restitution. The vote concluded with 90.9% of staked validator votes approving the recovery. The Sui Foundation announced it would abstain from the vote to maintain neutrality, and conditioned its support on Cetus publicly committing to full customer restitution. Cetus received a $30 million loan from the Sui Foundation to assist in compensating users and relaunched the protocol 17 days after the exploit. The emergency intervention was widely criticized by blockchain developers and researchers as evidence of meaningful centralization. Justin Bons, founder and CIO of Cyber Capital, labeled the action 'the very definition of centralization,' noting Sui operates with only approximately 114 active validators compared to Ethereum's more than 900,000 validators, enabling rapid coordinated action that most decentralized networks could not replicate. Critics argued the intervention demonstrated that a supermajority of Sui validators can effectively blacklist any address and override wallet ownership, raising concerns about censorship resistance and permissionlessness. Supporters countered that the coordinated response was a legitimate governance mechanism that prioritized user protection. The incident reignited the 'code is law' debate within the crypto community, as the attacker's control of on-chain assets was overridden by coordinated validator action rather than by any vulnerability in the attacker's own wallet.","heading":"Validator Censorship and the Centralization Controversy","severity":"critical","sources":[{"credibility":2,"name":"Sui network votes to hack the hacker who drained $220m from Cetus — DL News","type":"news","url":"https://www.dlnews.com/articles/defi/sui-validators-votes-hack-the-cetus-hacker-and-return-160m/"},{"credibility":2,"name":"$260 Million Cetus Hack on Sui Triggers Network Freeze — Critics Say 'Decentralization Is a Lie' — BeinCrypto","type":"news","url":"https://beincrypto.com/decentralization-trust-shaken-cetus-hack/"},{"credibility":2,"name":"Cetus Hack Exposes Potential Centralization Risks in Sui Ecosystem — Yellow","type":"news","url":"https://yellow.com/news/cetus-hack-exposes-potential-centralization-risks-in-sui-ecosystem"},{"credibility":1,"name":"Response to the Cetus Incident — Onchain Community Vote — Sui Official Blog","type":"official","url":"https://blog.sui.io/cetus-incident-response-onchain-community-vote/"},{"credibility":2,"name":"Sui Foundation stays neutral on $162M hack recovery plan — Crypto.news","type":"news","url":"https://crypto.news/sui-declines-vote-cetus-proposal-maintain-neutrality/"},{"credibility":2,"name":"SUI's $220 Million Crypto Hack Fuels Centralization Backlash — Bitcoinist","type":"news","url":"https://bitcoinist.com/sui-220-m-crypto-hack-centralization-backlash/"}]},{"content":"In January 2026, blockchain investigator ZachXBT disclosed the details of a theft of approximately $29 million worth of SUI tokens from a major holder that occurred in December 2024. According to ZachXBT's investigation, the attacker stole approximately 6.27 million SUI tokens. The stolen funds were then bridged from the Sui network to Ethereum using cross-chain bridge tools and subsequently laundered through Tornado Cash in smaller tranches to obscure the trail. ZachXBT noted that the investigation was significantly hampered by the limitations of Sui's on-chain analytics tools and block explorers, which lack the sophistication of Ethereum-based tools such as Etherscan. He had previously advised the Sui Foundation to invest in professional blockchain analytics infrastructure — specifically tools comparable to TRM Labs — but reported seeing minimal progress on this front. The source of the initial compromise — whether a private key theft or a smart contract vulnerability — was not definitively established in public reporting. The incident was not widely covered in the immediate aftermath due to the December disclosure gap.","heading":"ZachXBT: $29 Million SUI Token Theft and Tornado Cash Laundering","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Reveals Details of $29 Million SUI Token Theft — BeinCrypto","type":"news","url":"https://beincrypto.com/zachxbt-reveals-details-of-sui-token-theft/"},{"credibility":3,"name":"Major Sui Exploit: $29 Million Stolen And Laundered With Tornado Cash — TronWeekly","type":"news","url":"https://www.tronweekly.com/sui-exploit-reveals-29-million-sui-token-theft/"},{"credibility":3,"name":"Sui Network Exploit Leads to $29M Token Theft and Laundering — Crypto News Flash","type":"news","url":"https://www.crypto-news-flash.com/sui-network-exploit-leads-to-29m-token-theft-and-laundering/"},{"credibility":3,"name":"$29M SUI Token Theft Exposed, Blockchain Risks Grow — CoinPaprika","type":"news","url":"https://coinpaprika.com/news/-29m-sui-token-theft-exposed-blockchain-risks-grow/"}]},{"content":"On approximately July 6, 2025, ZachXBT publicly announced that he would no longer accept or pursue investigation cases related to the Sui ecosystem. His stated reason was the persistent lack of support from the Sui ecosystem — both in terms of financial backing for investigative work and in terms of the ecosystem's failure to build adequate blockchain analytics and incident-response infrastructure. ZachXBT had previously urged the Sui Foundation to invest in professional-grade analytics tooling comparable to TRM Labs and Etherscan but reported seeing minimal uptake. His withdrawal means that the Sui ecosystem has lost a significant source of independent on-chain threat intelligence. No public response from the Sui Foundation or Mysten Labs to ZachXBT's withdrawal announcement has been reported. The departure is notable because ZachXBT's work has historically been one of the primary mechanisms by which crypto ecosystems surface scam activity, identify bad actors, and coordinate freezes of stolen funds across exchanges.","heading":"ZachXBT Withdraws from Sui Ecosystem Investigations","severity":"high","sources":[{"credibility":3,"name":"ZachXBT Halts Sui Investigations Due to Lack of Ecosystem Support — AInvest","type":"news","url":"https://www.ainvest.com/news/zachxbt-halts-sui-investigations-due-to-lack-of-ecosystem-support-25071010bafdd62b88555d8a/"},{"credibility":3,"name":"ZachXBT: Since it has not received support from Sui ecosystem, we will not take on its ecosystem cases — MEXC News","type":"news","url":"https://www.mexc.com/news/zachxbt-since-it-has-not-received-support-from-sui-ecosystem-we-will-not-take-on-its-ecosystem-cases/36582"},{"credibility":3,"name":"ZachXBT Calls Out Sui Over Poor Incident Response Infrastructure — Pro Blockchain","type":"news","url":"https://pro-blockchain.com/en/zachxbt-calls-out-sui-over-poor-incident-response-infrastructure"},{"credibility":3,"name":"ZachXBT Ceases Sui Ecosystem Investigations — Bitget News","type":"news","url":"https://www.bitget.com/news/detail/12560604851436"}]},{"content":"Sui's token distribution has been subject to sustained criticism regarding concentration of supply. With a total capped supply of 10 billion SUI tokens, critics — most prominently Justin Bons of Cyber Capital — alleged that founders collectively control approximately 84% of the staked supply, noting that the staked amount exceeded 8 billion tokens at peak, with the founder-affiliated stake representing a dominant share. Bons specifically highlighted the 52% of total supply designated as 'unallocated' until 2030, raising concerns about whether the Sui Foundation or for-profit entity Mysten Labs effectively controls this stake. The Sui Foundation responded that locked tokens are custodied by independent third parties — specifically BitGo, Anchorage, and Coinbase Prime — and that 'the founders of Mysten Labs do NOT control the Sui Foundation treasury, the community reserve, stake subsidies, or any tokens allocated to investors.' In October 2024, pseudonymous crypto analyst Lightcrypto alleged on X that SUI insiders had sold $400 million worth of tokens during the token's approximately 100% price rally. Wallets associated with the SUI ICO allocation were reported to have moved large volumes during the surge. The Sui Foundation denied that any insiders — including Foundation employees, Mysten Labs founders, or investors — had sold $400 million in aggregate, and attributed the wallet activity to an 'infrastructure partner' operating under a lockup schedule. Kyle Samani of Multicoin Capital publicly noted the response was vague, implying it excluded some categories of participants from the denial. The minimum validator stake requirement of 30 million SUI has also been cited as a barrier to validator entry, further concentrating staking power. Sui's Nakamoto coefficient stood at 18–19 as of Q1–Q2 2025, which is above median for proof-of-stake networks per Messari, but critics argue this metric does not fully capture token-level concentration risk.","heading":"Token Centralization, Supply Control, and Alleged Insider Selling","severity":"high","sources":[{"credibility":2,"name":"Sui Refutes $400 Million Insider Trading Allegations — Decrypt","type":"news","url":"https://decrypt.co/286271/sui-refutes-400-million-insider-selling-allegations-following-rapid-token-rise"},{"credibility":1,"name":"Sui Foundation disputes $400 million insider selling allegation — The Block","type":"news","url":"https://www.theblock.co/post/320995/sui-disputes-400-million-insider-selling-allegation"},{"credibility":2,"name":"SUI price rally sparks $400M insider selling allegations — CoinTelegraph","type":"news","url":"https://cointelegraph.com/news/sui-price-rally-400-m-insider-selling-allegations"},{"credibility":2,"name":"Sui Network Tokenomics Raises Concerns With 84% Control of the Founders — CoinGape","type":"news","url":"https://coingape.com/sui-network-tokenomics-raises-concerns-with-84-control-of-the-founders/"},{"credibility":2,"name":"Sui Rejects Centralization Claims, Do Founders Really Control 84% of Token Supply? — CCN","type":"news","url":"https://www.ccn.com/news/technology/sui-rejects-centralization-claims-who-controls-locked-tokens/"},{"credibility":2,"name":"Sui (SUI) Tokenomics and Vesting Schedule — Tokenomist","type":"research","url":"https://tokenomist.ai/sui"}]},{"content":"Sui's token unlock schedule extends through 2030, with significant unlock events concentrated in 2025. Major scheduled unlocks included approximately 74 million SUI on May 1, 2025, 64 million SUI on June 1, 2025, and approximately 44 million SUI in each of July, August, and October 2025. The October 2025 unlock included allocations to Series B investors, contributors, and Mysten Labs, representing approximately $145 million at then-prevailing prices. Token unlocks are distributed across multiple categories: Mysten Labs treasury, early contributors, Series A and B investors, community reserve, and stake subsidies. The extended unlock schedule through 2030, combined with the large proportion of supply held by insiders and investors, creates ongoing potential sell pressure. The insider selling allegations of October 2024 coincided with a period of significant token price appreciation, raising concerns about whether unlock recipients time distributions opportunistically.","heading":"Token Unlock Schedule and Sell Pressure","severity":"medium","sources":[{"credibility":2,"name":"Sui (SUI) Tokenomics and Vesting Schedule — Tokenomist","type":"research","url":"https://tokenomist.ai/sui"},{"credibility":3,"name":"SUI Token Unlock Schedule: Key Dates for Investors in 2026 — Cubix","type":"research","url":"https://www.cubix.co/blog/sui-token-unlock-schedule/"},{"credibility":2,"name":"SUI, ENA, EIGEN Lead October's Biggest Token Unlocks — BeinCrypto","type":"news","url":"https://beincrypto.com/crypto-token-unlocks-first-week-of-october/"}]},{"content":"Sui operates with a relatively small active validator set — approximately 114 to 127 validators as of mid-2025 — compared to Ethereum's more than 900,000 validators. This small validator set enabled the rapid, coordinated response to the Cetus hack but simultaneously demonstrated that a supermajority of validators can effectively blacklist addresses and override on-chain asset ownership without a full protocol fork. The minimum stake requirement to become a validator — 30 million SUI — acts as a meaningful barrier to entry that further concentrates the validator set. The Nakamoto coefficient of 18–19 (Q1–Q2 2025) reflects that fewer than 20 entities control enough stake to reach a 33% Byzantine fault threshold, which Messari notes is above the median for proof-of-stake networks. However, Cyber Capital's Justin Bons argued that the Nakamoto coefficient alone does not capture the degree of influence Mysten Labs and affiliated entities exercise over staking decisions, particularly given the concentrated 'unallocated' supply. The Cetus vote, in which 90.9% of validator stake voted in favor of the fund recovery override, demonstrated the practical ability of the validator set to act as a de facto governance body over user asset control — a capability that most permissionless blockchain designs explicitly attempt to preclude.","heading":"Validator Concentration and Governance Risk","severity":"high","sources":[{"credibility":2,"name":"$160M in stolen funds puts Sui's decentralization to the test — Blockworks","type":"news","url":"https://blockworks.co/news/suis-decentralization-dex-put-to-the-test"},{"credibility":2,"name":"State of Sui Q2 2025 — Messari","type":"research","url":"https://messari.io/report/state-of-sui-q2-2025"},{"credibility":2,"name":"$220M Sui Cetus Hack Sparks Oracle and Validator Debate — CryptoRank","type":"news","url":"https://cryptorank.io/news/feed/82c38-220-m-sui-cetus-hack-sparks-oracle-and-validator-debate"}]},{"content":"Mysten Labs met with the U.S. Securities and Exchange Commission's Crypto Task Force in 2025, attended by legal representatives from Sidley Austin LLP, to discuss the regulatory classification of SUI and broader blockchain asset regulation. Mysten Labs advocated for a 'fit-for-purpose' regulatory framework and argued against applying existing securities laws to utility blockchain networks. A spot SUI ETF application by 21Shares was under SEC review as of late 2025, with the SEC postponing its decision multiple times, reflecting the broader regulatory uncertainty around classifying SUI as a commodity versus security. Mysten Labs also submitted written input to the SEC's Crypto Task Force in May 2025. No enforcement actions by the SEC or CFTC against Mysten Labs or the Sui Foundation have been publicly filed or disclosed. A spot SUI ETF with staking rewards was listed on the Nasdaq by Canary in February 2026, marking a notable step toward mainstream institutional access.","heading":"Regulatory Engagement and ETF Consideration","severity":"low","sources":[{"credibility":2,"name":"Sui Blockchain Developer Meets with SEC to Address Crypto Regulation Issues — CoinCentral","type":"news","url":"https://coincentral.com/sui-blockchain-developer-meets-with-sec-to-address-crypto-regulation-issues/"},{"credibility":1,"name":"Mysten Labs' Response to SEC Crypto Task Force — SEC.gov","type":"official","url":"https://www.sec.gov/files/ctf-written-input-mysten-labs-050925.pdf"},{"credibility":1,"name":"Canary debuts spot SUI ETF with staking on the Nasdaq — CoinDesk","type":"news","url":"https://www.coindesk.com/markets/2026/02/18/canary-lists-spot-sui-etf-with-staking-rewards"}]},{"content":"ZachXBT and other security researchers have repeatedly identified deficiencies in Sui's on-chain analytics infrastructure as a systemic risk factor. Unlike Ethereum — which benefits from Etherscan, Dune Analytics, TRM Labs coverage, and a large ecosystem of independent forensics tooling — Sui's block explorer and analytics ecosystem remained underdeveloped as of mid-2025. This limits the ability of investigators, exchanges, and users to trace stolen funds, identify scam wallets, and coordinate incident response. The limitation was directly cited by ZachXBT as the reason he could not adequately investigate the December 2024 $29 million theft. The Cetus hack further underscored the gap: while Elliptic was able to trace the cross-chain laundering route, the initial on-Sui tracing relied primarily on protocol-specific tooling rather than generalized infrastructure. Mysten Labs warned Sui wallet users separately about token spam attacks — where unsolicited tokens are airdropped to user wallets as a phishing vector — indicating active scam activity targeting the ecosystem's user base.","heading":"Ecosystem Security Infrastructure Deficiencies","severity":"medium","sources":[{"credibility":3,"name":"ZachXBT Halts Sui Investigations Due to Lack of Ecosystem Support — AInvest","type":"news","url":"https://www.ainvest.com/news/zachxbt-halts-sui-investigations-due-to-lack-of-ecosystem-support-25071010bafdd62b88555d8a/"},{"credibility":2,"name":"Scam Alert: Mysten Labs Warns of Token Spam on Sui Wallets — CoinGape","type":"news","url":"https://coingape.com/scam-alert-mysten-labs-warns-of-token-spam-on-sui-wallets/"},{"credibility":2,"name":"Sui shares details on $220M Cetus exploit, vows to step up security — Blockworks","type":"news","url":"https://blockworks.com/news/sui-cetus-exploit-dex-security"}]}],"sources_used":[],"summary":"Sui is a Layer 1 blockchain developed by Mysten Labs, launched in May 2023 and built on the Move programming language. The network suffered one of the largest DeFi exploits of 2025 when Cetus Protocol — its primary DEX — was drained of approximately $223 million in May 2025, triggering a controversial emergency validator vote to freeze and reclaim stolen funds that exposed deep centralization concerns. Separately, ZachXBT investigated a $29 million SUI token theft in late 2024 involving Tornado Cash laundering and subsequently announced in July 2025 that he would no longer take Sui ecosystem cases due to inadequate incident-response infrastructure and lack of support from the ecosystem.","timeline":[{"date":"2023-05","event":"Sui mainnet launched by Mysten Labs.","source":"Mysten Labs official","source_url":"https://www.mystenlabs.com/"},{"date":"2024-10","event":"Pseudonymous analyst Lightcrypto alleges $400 million in SUI insider selling during a token price rally of approximately 100%. Sui Foundation denies the allegation, attributing activity to an infrastructure partner.","source":"The Block / Decrypt","source_url":"https://www.theblock.co/post/320995/sui-disputes-400-million-insider-selling-allegation"},{"date":"2024-12","event":"Approximately $29 million worth of SUI tokens (6.27 million SUI) stolen from a major holder. Funds are subsequently bridged to Ethereum and laundered through Tornado Cash.","source":"BeinCrypto / ZachXBT","source_url":"https://beincrypto.com/zachxbt-reveals-details-of-sui-token-theft/"},{"date":"2026-01","event":"ZachXBT publicly discloses details of the December 2024 $29 million SUI theft and Tornado Cash laundering, noting Sui's deficient analytics infrastructure hampered the investigation.","source":"BeinCrypto","source_url":"https://beincrypto.com/zachxbt-reveals-details-of-sui-token-theft/"},{"date":"2025-05-22","event":"Cetus Protocol — Sui's largest DEX — exploited for approximately $223 million via a math library overflow bug. Approximately $60 million bridged to Ethereum before validators intervene.","source":"CoinDesk / Cyfrin / Halborn","source_url":"https://www.coindesk.com/markets/2025/05/22/sui-networks-cetus-protocol-hit-in-apparent-hack-sending-token-prices-down-90"},{"date":"2025-05-22","event":"Sui validators coordinate emergency freeze of approximately $162 million in attacker-controlled addresses on Sui, preventing further bridging of stolen funds.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/sui-validators-votes-hack-the-cetus-hacker-and-return-160m/"},{"date":"2025-05-29","event":"On-chain community vote concludes with 90.9% of validator stake approving recovery of frozen Cetus funds. Vote sparks broad centralization debate across the crypto industry.","source":"Sui Official Blog / DL News","source_url":"https://blog.sui.io/cetus-incident-response-onchain-community-vote/"},{"date":"2025-05","event":"Mysten Labs submits written input to the SEC Crypto Task Force regarding blockchain asset classification.","source":"SEC.gov","source_url":"https://www.sec.gov/files/ctf-written-input-mysten-labs-050925.pdf"},{"date":"2025-06-08","event":"Cetus Protocol relaunches 17 days after the exploit, backed by a $30 million Sui Foundation loan and recovered frozen funds.","source":"The Block","source_url":"https://www.theblock.co/post/357386/sui-dex-cetus-protocol-restarts-platform-after-recovering-from-223-million-exploit"},{"date":"2025-07-06","event":"ZachXBT publicly announces he will no longer investigate Sui ecosystem cases, citing persistent lack of ecosystem support and inadequate blockchain analytics infrastructure on Sui.","source":"AInvest / MEXC News","source_url":"https://www.ainvest.com/news/zachxbt-halts-sui-investigations-due-to-lack-of-ecosystem-support-25071010bafdd62b88555d8a/"},{"date":"2025-09","event":"Mysten Labs meets with the SEC Crypto Task Force, attended by Sidley Austin LLP, to discuss regulatory classification and framework for Sui.","source":"CoinCentral","source_url":"https://coincentral.com/sui-blockchain-developer-meets-with-sec-to-address-crypto-regulation-issues/"},{"date":"2026-02-18","event":"Canary Capital lists a spot SUI ETF with staking rewards on the Nasdaq, marking a milestone for institutional access to the SUI token.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/02/18/canary-lists-spot-sui-etf-with-staking-rewards"}]},"v":1}