Cetus Protocol posted a $5 million reward on May 23 for information that identifies and leads to the arrest of the attacker who extracted $223 million from its decentralized exchange on the Sui network.
Announced on May 23, the offer is coordinated with cybersecurity firm Inca Digital and will be funded by the Sui Foundation if the tip proves decisive.
Informants must email the perpetrator’s name, location, and supporting proof with the subject “Cetus lead.” The DEX added that it would withdraw any civil action and cancel the bounty should the exploiter return the assets and accept the earlier settlement proposal.
Notably, the offer comes amid centralization concerns regarding Sui following the freezing of $162 million by many of its 114 validators.
Whitehat offer sets the stage
Hours before the public bounty, Cetus used an on-chain transaction to deliver a separate proposal to the attacker on Sui and Ethereum (ETH) blockchains.
That note offered a $6 million retention fee, equivalent to 2,324 ETH, in exchange for the return of 20,920 ETH and all frozen amounts on Sui.
The team said it had mapped the exploiter’s Ethereum wallets and was coordinating with US federal authorities, FinCEN, the Seychelles Police Force, selected defense-sector partners, major exchanges, and bridge operators.
The ultimatum warned that any attempt to launder funds would trigger a global law-enforcement escalation.
Per the protocol’s May 22 incident disclosure on X, the attacker targeted a flaw in Cetus’ pricing mechanism, prompting an immediate pause of all smart-contract activity. The project’s blockchain data shows that the exploit yielded $223 million in tokens.
Of that sum, $61 million was moved to Ethereum via bridges, while the remaining $162 million was frozen by Sui network validators.
Cetus has not revealed when normal trading will resume or whether the team will implement code changes before reactivating the contracts.
Validator action sparks decentralization debate
According to its block explorer, Sui hosts 114 active validators. On May 22, Sui stated that a broad plurality agreed to reject any transaction originating from the attacker’s wallets shortly after the breach.
The collective freeze prevented the remaining $162 million transfer and locked the tokens on-chain.
Gautham Santhosh, co-founder of Polynomialfi, wrote on X that the crypto community is now weighing the benefit of rapid asset protection against the implication that validators can suspend specific accounts at will.
Although he highlighted that the process demanded consensus and was not arbitrary, the episode has changed the security assumptions regarding layer-1 blockchains.
