When the news broke of the $223 million hack on Sui's decentralized exchange (DEX) Cetus, it was clear that something was amiss. The protocol lost a staggering amount of funds to an exploit on May 22, leaving users and investors reeling. But what's even more striking is that Cetus' recovery plan mirrors a successful strategy used by another Solana project three years ago: Crema Finance.
It turns out that the developers behind Cetus have been here before, having previously saved Crema Finance from a $9-million hack in 2022. The bounty offer to recover stolen funds from Sui-based DEX Cetus closely resembles the strategy employed by Crema, where hackers were offered a deal to return funds while keeping $1.6 million in exchange for not reporting the attack to law enforcement.
But who exactly is behind both projects? According to Norbert Bodziony, founder of Nightly App, the connection between Cetus and Crema Finance is "commonly known" in Sui's developer circles. And it turns out that both projects are founded by none other than Henry Du.
Solana project Crema Finance suffered a $9-million hack in 2022, but managed to recover most of the funds through negotiation with the hacker. Now, Cetus is relying on the same strategy, offering a similar deal to return all but $6 million of the stolen funds in exchange for a promise not to pursue legal action.
The size of the bounty has sparked backlash from users, who are calling for a formal compensation plan instead. Several community members argue that even if funds are recovered, most of the damage has already been done – especially to holders of the CETUS token, which plummeted in value following the incident.
Meanwhile, Sui validators are also under fire for their role in freezing the funds. The move is aimed at aiding recovery, yet critics say it exposes centralization risks in the network. "SUI's validators are colluding to CENSOR the hacker's TXs right now! Does that make SUI centralized? The short answer is YES; what matters more is why?" wrote Justin Bons, founder of Cyber Capital.
Sui has just 114 validators – far fewer than its more established smart contract peers. Ethereum has over 1 million validators, while Solana has 1,157. But despite the criticism, members of the Sui community are defending the move, arguing that this is how real-world decentralized chains should function.
"Decentralization isn’t about standing by while people get hurt, it’s about the power to act together, without needing permission," said one member of the Sui community. But the debate over decentralization highlights a deeper issue: who holds the reins in supposedly decentralized networks like Sui?
The Cetus exploit has spotlighted the persistent security challenges in DeFi while raising questions around centralization and trust. The team’s $6-million offer to the hacker mirrors the playbook it used with Crema – but this time, the crypto community isn’t as forgiving. With CETUS tanking, trust fractured, and validators freezing funds, critics are asking whether Sui's decentralization is more appearance than reality.
The debate over decentralization isn't unique to Sui. When Bybit lost $1.4 billion in a February hack linked to North Korean state actors, security experts and users urged platforms like THORChain and eXch to block the funds. In that case, THORChain received some backlash for not stepping in, which is the exact opposite of what Sui is being criticized for now.
As of now, the hacker hasn't accepted Cetus' offer. Two Ethereum wallets tied to the exploiter still hold over $60 million in ETH, with no movement at the time of writing. The Sui addresses remain paralyzed. Will they accept the offer and recover some of their losses? Only time will tell.
In the meantime, the crypto community is left to ponder whether Sui's decentralization is more appearance than reality. With persistent security challenges and centralization concerns, it's clear that there's still much work to be done to build trust in these supposedly decentralized networks.