Technical Analysis: How Sui "froze" 160 million USD from hackers?

Author: Haotian

Many people are puzzled. After the official Sui claimed that @CetusProtocol was attacked by hackers, the validator network coordinated to "freeze" the hacker's address, recovering 160 million dollars. How exactly did they do that? Is decentralization really a "lie"? Below, let's try to analyze this from a technical perspective:

Part of the cross-chain bridge transfer: After a successful hacker attack, a portion of assets such as USDC was immediately transferred to other chains like Ethereum through the cross-chain bridge. This portion of funds is unrecoverable, as once it leaves the Sui ecosystem, the validators are powerless.

Part still on the Sui chain: A considerable amount of stolen funds is still stored in Sui addresses controlled by hackers. This portion of the funds has become the target of "freezing."

According to the official announcement, "many validators have identified the addresses of the stolen funds and are ignoring transactions on these addresses."

—— How exactly is it implemented?

1. Transaction filtering at the validator level - simply put, validators collectively "turn a blind eye":

• Validators directly ignore transactions from hacker addresses during the transaction pool (mempool) phase;

• These trading techniques are technically completely valid, but they just don't get packaged on-chain;

• The hacker's funds are thus "house arrested" in the address;

2. The key mechanism of the Move object model - The object model of the Move language makes this "freezing" feasible:

• Transfers must be on-chain: Although hackers control a large amount of assets in the Sui address, to transfer these USDC, SUI, and other objects, a transaction must be initiated and confirmed by validators.

• Validators hold absolute power: If a validator refuses to package, the object will remain immobile forever;

• Result: The hacker nominally "owns" these assets, but in reality has no way to access them.

It's like you have a bank card, but all ATMs refuse to serve you. The money is on the card, but you can't take it out. With the continuous monitoring and interference of SUI validator nodes (ATMs), the SUI and other tokens in the hacker's address will be unable to circulate, and these stolen funds are now effectively "destroyed," objectively playing a role in "deflation"?

Of course, in addition to temporary coordination by validators, Sui may have preset a deny list function at the system level. If so, the process might be: relevant authorized parties (such as the Sui Foundation or through governance) will add hacker addresses to the system deny_ list, and validators will execute based on this system rule, refusing to process transactions from blacklisted addresses.

Whether it is temporary coordination or execution according to system rules, it requires the majority of validators to act in unison. Clearly, the power distribution of Sui's validator network is still too centralized, with a few nodes able to control key decisions across the entire network.

The issue of validator centralization in Sui is not unique to PoS chains—most PoS networks, from Ethereum to BSC, face similar risks of validator centralization; it's just that Sui has exposed the problem more clearly this time.

——How can a so-called decentralized network have such a strong centralized "freezing" ability?

What’s even more alarming is that the Sui official stated they would return the frozen funds to the pool, but if the validators really "refuse to package transactions," these funds should theoretically never be movable. How does Sui manage to return them? This further challenges the decentralized nature of the Sui chain!

Is it true that, apart from a few centralized validators refusing transactions, the authorities even have super permissions at the system level to directly modify asset ownership? (Further details on "freezing" need to be provided by Sui)

Before disclosing specific details, it is necessary to discuss the trade-offs around decentralization:

Is it necessarily a bad thing to sacrifice a bit of decentralization in emergency response interventions? If faced with a hacker attack, is it really what users want for the entire chain to be powerless?

What I want to say is that naturally, no one wants their money to fall into the hands of hackers. However, this move raises greater concerns in the market: the criteria for freezing funds become completely "subjective": what counts as "stolen funds"? Who defines it? Where are the boundaries? Today we freeze hackers, who will we freeze tomorrow? Once this precedent is set, the core value of censorship resistance in public chains will be completely undermined, inevitably leading to a loss of user trust.

Decentralization is not black and white; Sui has chosen a specific balance point between user protection and decentralization. The key issue lies in the lack of transparent governance mechanisms and clear boundary standards.

At this stage, most blockchain projects are making this kind of trade-off, but users have the right to know the truth, rather than being misled by the label of 'fully decentralized'.