Blockchain security firm Dedaub published a post-mortem report on the hack of the Cetus decentralized exchange, pinpointing the root cause as an exploit in the liquidity parameters of the Cetus automated market maker (AMM) that bypassed a code "overflow" check. The report explains that the attackers took advantage of a weakness in the most significant bits (MSB) check, enabling them to manipulate liquidity parameter values by several orders of magnitude and open disproportionately large positions almost instantly. Dedaub’s researchers stated: "This allowed them to add massive liquidity positions with just one unit of token input, subsequently draining pools collectively containing hundreds of millions of dollars worth of tokens. " This event and the accompanying analysis highlight the ongoing issue of cybersecurity breaches affecting the crypto and Web3 sectors. Industry leaders have repeatedly cautioned that firms must implement robust safeguards to protect users before regulatory authorities intervene and enforce protections. Related: Twice lucky?

Cetus’ recovery plan on Sui mirrors a Solana blueprint Cetus decentralized exchange hack causes $223 million loss On May 22, Cetus faced a hack resulting in $223 million in user losses within 24 hours. Following the attack, Cetus and the Sui Foundation announced that Sui network validators managed to freeze a large portion of the stolen assets. According to Cetus, $163 million of the $223 million was frozen by validators and ecosystem partners on the same day as the breach. Mixed responses and centralization concerns over freeze action The move to freeze the stolen funds received mixed reactions from the crypto community, with advocates for decentralization criticizing the validators’ intervention and control over the blockchain. “Sui validators are actively censoring transactions across the blockchain, ” one user commented on X, reflecting a widely shared sentiment. “This completely undermines the principles of decentralization and reduces the network to a centralized, permissioned database, ” the user added. Steve Bowyer also noted on May 23 on X: “It’s interesting how many Web3 projects backed by VCs lean heavily on centralization, despite borrowing Bitcoin’s ethos. ”