The Cetus Hack and Lessons for Web3: MSB Vulnerabilities, Criticism of Centralized Interference, and New Security Standards with Multi-Sig Wallets

Blockchain security firm Dedaub has published a detailed report on the hack of decentralized exchange Cetus that occurred on May 22, 2025, which resulted in users losing approximately $223 million 1 3 7 .

Reason for hacking

The main reason for the attack was a vulnerability in the verification of liquidity parameters of the automated market maker (AMM) Cetus . In particular, the protocol code contained an error in the verification of the most significant bits (MSB), which allowed the attackers to manipulate the values of liquidity parameters by several orders of magnitude. This vulnerability was not detected during the standard code overflow check, which allowed the hackers to exploit the bug 1 3 5 7 .

The hackers were able to artificially inflate liquidity values using just one unit of token input, and then instantly open disproportionately large positions. This allowed them to drain liquidity pools containing hundreds of millions of dollars in tokens 1 3 7 9 .

The course of the attack and its consequences

During the attack, the attackers used fake tokens such as BULLA and MOJO to trick the system and gain large liquidity positions with minimal investment. The main damage was inflicted on the SUI/USDC pool, which lost about $11 million. In total, the damage amounted to $223 million, of which $163 million was frozen by Sui network validators and ecosystem partners on the same day 3 7 9 .

Reaction and criticism

The decision by Sui network validators to freeze a significant portion of the stolen assets has caused a mixed reaction in the crypto community. Decentralization advocates have criticized the intervention, claiming that it undermines the principles of decentralization and turns the blockchain into a centralized, controlled database . Social media users have noted that validators are actively censoring transactions, which is contrary to the ideology of Web3 3 7 .

Renowned expert Steve Boyer also noted that many venture-backed Web3 projects actually rely on centralization, despite borrowing ethics from Bitcoin 3 .

The significance of the incident for the industry

Dedaub’s report and the incident itself highlight the ongoing problem of cybersecurity failures that are having a major impact on the crypto market and Web3 industry . Industry leaders have repeatedly warned that companies must strengthen security measures and protect users to avoid similar disasters before regulators begin to impose tough requirements 1 7 .

Additional measures

In response to the hack, the Cetus team, together with Inca Digital, announced a $5 million reward for information leading to the identification and arrest of the perpetrators. It is also known that New Zealand police have detained one of the suspects associated with an international group responsible for large-scale cryptocurrency thefts 5 8 .

Thus, the hack of the decentralized exchange Cetus was the result of a technical vulnerability in the verification of AMM liquidity parameters, which allowed hackers to quickly and massively withdraw funds. The Sui network’s response to the incident has sparked discussions about the balance between decentralization and the need to quickly respond to security threats. This case serves as an important lesson for the entire crypto industry about the need for careful code review and increased user protection measures.

How Exactly a Vulnerability in MSB Validation Allowed Attackers to Manipulate Liquidity on Cetus

A vulnerability in the most significant bit (MSB) verification in the Cetus automated market maker (AMM) protocol allowed attackers to manipulate liquidity parameter values by several orders of magnitude.

Technically, this is how it happened: when processing liquidity parameters, the Cetus code did not correctly check the most significant bits of the binary representation of numbers. Because of this, hackers could change these most significant bits, which radically changed the final value of the parameter. As a result, using just one unit of token input, attackers could create artificially inflated liquidity volumes – that is, open disproportionately large positions in liquidity pools.

This gave them the ability to literally “add huge liquidity positions” with one click, which then allowed them to quickly withdraw funds from pools worth hundreds of millions of dollars. This manipulation was possible precisely because the overflow check and parameter validation did not correctly account for the most significant bits, which became the technical vulnerability exploited in the attack 1 2 3 .

Thus, a vulnerability in the MSB verification allowed hackers to bypass the restrictions on the size of liquidity parameters, which led to a large-scale hack and the loss of $223 million on the Cetus exchange.

What security measures do experts recommend to prevent such attacks in Web3?

Web3 security experts recommend a comprehensive approach to prevent attacks like the Cetus decentralized exchange hack, including the following key measures:

Thorough audit of smart contracts and code . Regular and deep source code audits, including overflow and bit handling checks (including MSB), allow identifying vulnerabilities before protocols are launched 1 3 .
Real-time monitoring and analytics . Constantly monitoring blockchain activity helps quickly identify anomalies and potential attacks, allowing you to respond to threats faster 1 .
Use of multi-layered security systems . In Web3, single-layer solutions are not enough – it is recommended to implement multi-factor authentication (2FA), anti-phishing codes, verification of withdrawal addresses and other protective mechanisms 1 6 .
Secure storage of private keys . The use of hardware wallets, multi-signatures and private computing (MPC) technologies significantly reduces the risk of key compromise 1 5 9 .
Software and infrastructure updates : Regularly updating clients, wallets, and smart contracts helps to eliminate known vulnerabilities and increase resistance to new types of attacks 1 4 5 .
Adherence to the principles of decentralization and minimization of centralization . Avoiding excessive control by validators and ensuring distributed governance reduces the risks of censorship and abuse, while maintaining user trust 3 .
Educate users and developers : Raising awareness of social engineering, phishing, and other types of attacks helps protect tools and data at the end-user level 1 5 .
Investment in innovative security technologies . Using artificial intelligence to detect attacks and anomalies, as well as implementing new cryptographic methods, strengthens the security of the Web3 ecosystem 1 7 .

Overall, experts emphasize that Web3 security requires a comprehensive, systemic approach that combines technical measures, audit processes, and enhancing the security culture among all ecosystem participants. This is the only way to minimize risks and ensure sustainable development of the industry.

Why the asset freeze has sparked criticism and how it affects the principles of decentralization

The freezing of assets following the hack of the decentralized exchange Cetus has drawn criticism as it goes against the fundamental principles of decentralization that underlie blockchain technology and Web3.

The main reason for criticism is that the intervention of validators and freezing of funds effectively creates centralized control over the network , which is perceived as a violation of the idea of an open and uncontrolled blockchain. Users and supporters of decentralization believe that such actions turn the blockchain into an ordinary centralized database with censorship of transactions and restrictions on user freedom.

As experts point out, such measures set a precedent of interference that could undermine trust in decentralized systems and lead to increased centralization. This contradicts the ideal in which no network participant should have the power to cancel or block transactions. In the crypto community, such actions are perceived as a step back from decentralization, which causes concern and controversy.

On the other hand, failure to act in such situations may result in stolen funds being quickly laundered through anonymous services and decentralized exchanges, which increases the risks for the entire ecosystem and may provoke stricter regulation by government agencies.

Thus, the asset freeze crisis reflects a difficult balance between the need to promptly protect users and preserve the principles of decentralization . This conflict is one of the key dilemmas in the development of Web3 and the crypto industry as a whole 1 2 6 .

“Sui validators actively censor transactions across the blockchain, which undermines the principles of decentralization and turns the network into a centralized, controlled database,” critics say.

Ultimately, such incidents force the community and developers to look for new security mechanisms that can effectively combat attacks without sacrificing the decentralized nature of the blockchain.

What implications might centralized validator intervention have for trust in the Sui network?

The centralized intervention of Sui network validators, which resulted in the freezing of approximately $160 million in stolen assets following the Cetus protocol hack, has significant implications for trust in the network itself.

Key implications for trust:

Undermining the principles of decentralization . The ability of validators to unilaterally block addresses and freeze funds is perceived as an expression of centralized control. On the Sui network, with only about 127 active validators (compared to hundreds of thousands on Ethereum), this concentration of power raises concerns about single points of failure and the possibility of transaction censorship. This runs counter to the ideal of blockchain as an open and unauthorized system 1 2 .
Growing skepticism and criticism from the community . Many in the crypto community and proponents of decentralization believe that such measures turn the blockchain into a centralized database with the possibility of interference, which reduces the level of trust in the network and its security as a decentralized platform 1 2 5 .
Impact on reputation and competitiveness . Although Sui’s infrastructure was not compromised, the incident exposed structural weaknesses in the security of the DeFi ecosystem and called into question the level of decentralization. This may lead investors and users to rethink their choice of platform, especially against the backdrop of successful upgrades by competitors such as Ethereum 1 4 .
Increased regulatory scrutiny . Centralized governance and intervention mechanisms may lead regulators to view such networks as traditional financial structures, subject to greater oversight and regulation. This may limit the flexibility and innovation of the Sui ecosystem in the future 1 2 .
Balance between security and decentralization . On the one hand, the prompt intervention of validators prevented further losses and returned some of the stolen funds, which maintains user confidence in the short term. On the other hand, this creates tension between the need for security and maintaining the decentralized nature of the network 1 5 6 .

How incidents like these could change the industry’s approach to securing crypto projects

The centralized intervention of Sui validators in the form of asset freezing highlights a difficult dilemma for blockchain networks: how to effectively protect users and quickly respond to attacks without undermining trust in the decentralization and openness of the system. In the near future, the Sui ecosystem plans to conduct a comprehensive review of the governance system and consider measures to increase decentralization in order to balance security and Web3 principles 1 2 .

Incidents of major hacks and attacks on crypto projects, such as the hack of the decentralized exchange Cetus, significantly change the industry’s approach to ensuring security. Based on the analysis of recent events and lessons from them, experts highlight several key areas of evolution of security practices in Web3 and the crypto industry as a whole:

Comprehensive security audit and testing . Incidents have shown that traditional smart contract audits are insufficient. A comprehensive audit is needed, including checking the infrastructure, operational processes, and interactions of components, as well as load testing and attack simulation. This helps identify vulnerabilities not only in the code, but also in the associated systems 1 .
Multi-level protection and enhanced access control . The use of multi-signature wallets (multisig) in combination with hardware keys and strict transaction confirmation procedures is becoming the standard. In this case, not only cryptographic reliability is important, but also the security of operational processes, training of employees and users in methods of counteracting phishing and social engineering 1 .
Monitoring and rapid response to incidents . Implementing systems to monitor transactions and network behavior in real time allows for faster detection of anomalies and prevention of large-scale losses. This requires the integration of analytics and artificial intelligence tools to identify suspicious activity 1 2 .
Protecting infrastructure and key services . Infrastructure vulnerabilities, such as compromised DNS servers, can lead to large-scale losses. Therefore, a systematic approach to protecting all elements of the ecosystem is important – from domain names to servers and client applications 2 .
Enhance security culture among users and teams . Regular training, attack simulations and awareness raising help to minimize risks associated with the human factor, which often becomes the weak link in the security chain 1 4 .
Innovation and automation of protection . The use of artificial intelligence and machine learning technologies for proactive threat detection, as well as automated solutions to protect digital assets and the reputation of companies, is becoming increasingly popular 4 .
Balance between decentralization and controllability . Incidents force the industry to search for optimal control models that will allow for prompt response to threats without sacrificing the principles of decentralization and uncontrollability of the network 1 .

Thus, the cryptocurrency and Web3 industry is moving from reactive measures to proactive, systemic and comprehensive security strategies that take into account both technical and organizational aspects. This contributes to the increased reliability of ecosystems and the strengthening of user and investor trust.

What New Security Measures Could Become Standard After Major Crypto Project Hacks

Following major crypto hacks, such as the Bybit exchange and the Cetus decentralized exchange, the industry is gradually forming new security standards. Key measures that could become mandatory and widespread include:

Multi-level security system with multi-signature wallets (multisig) and hardware wallets with strict access control, eliminating the possibility of bypassing security measures 1 .
A comprehensive security audit that covers not only smart contracts but also the entire infrastructure, development processes, and operational procedures. This audit includes penetration testing, checking anti-phishing mechanisms, and real-time transaction monitoring 1 2 .
Regularly updating software and hardware , including checking digital signatures of updates and testing backups, which reduces the risks of using outdated and vulnerable components 2 .
Train employees and users in phishing and social engineering countermeasures , including regular attack simulations to assess readiness and increase awareness 1 2 .
Using Security Operations Centers (SOCs) for 24/7 monitoring and rapid incident response, which helps minimize damage in the first “golden hours” after an attack 5 .
Cold storage of funds with multi-signature as a standard for large exchanges and projects, which reduces the risks of compromising hot wallets and centralized points of failure 5 .
Transparent communication with users in crisis situations to maintain trust and prevent panic 5 .
Bug bounty programs that incentivize ethical hackers to find and report security issues before they are exploited by malicious actors 5 .
Automation and implementation of artificial intelligence technologies for proactive detection of anomalies and suspicious activity in the network 4 .
Strengthening controls over exchange services and integration with AML/KYC systems to make it more difficult to launder stolen funds and increase the transparency of operations 3 .

As such, the industry is moving towards standardizing comprehensive, multi-layered and proactive security measures that cover both technical and organizational aspects, providing a higher level of protection for users and digital assets.

What Multi-Signature Wallet Measures Will Become the Standard for Protecting Cryptosystems

New multi-signature (Multi-Sig) wallet measures, which are becoming the standard for securing cryptosystems, include the following key elements:

Requiring multiple signatures to confirm a transaction . Instead of a single private key, multiple authorized parties must agree to transfer funds (e.g., a 2-of-3 scheme – two signatures out of three possible). This significantly reduces the risk of unauthorized access and asset theft, since compromising one key no longer gives full control over the funds 1 2 .
Distributed key management : Private keys are stored by different participants (teams, DAOs, organizations), eliminating a single point of failure and reducing the likelihood of abuse or errors associated with centralized storage 1 2 .
Flexible multi-signature schemes : The ability to configure various configurations – from simple (e.g. 2 out of 3) to complex ones involving multiple parties and conditions – allows you to tailor security to the specific needs of your business or community, balancing convenience and security 2 .
Time buffers and freezing mechanisms : Implementing delays before large transfers are made or the ability to pause transactions when suspicious activity occurs provides additional time to intervene and prevent losses 1 .
Integration with hardware wallets and two-factor authentication . Combining multi-signatures with physical key protection and additional verification layers increases the overall level of security 1 .
Transparency and auditability : Multi-signature wallets provide more transparent management of funds, as each transaction requires the approval of multiple participants, which reduces the risk of fraud and increases trust 1 2 .
Using smart contracts to implement multi-signatures . In networks such as Ethereum, multi-signatures are implemented through smart contracts, which provides additional flexibility and the ability to automate complex fund management rules 1 .

As a result, multi-signature wallets are becoming the standard for managing large crypto assets, corporate funds, DAOs, and DeFi projects, as they significantly increase resilience to attacks, reduce the risk of losing funds, and provide distributed control that complies with the security and decentralization principles of Web3 1 2 .

Summary and conclusion

The hack of the decentralized exchange Cetus was a clear example of how technical vulnerabilities, in particular improper verification of the most significant bits (MSB) in liquidity parameters, can lead to large-scale financial losses – in this case, more than $223 million. The incident highlighted the importance of thorough auditing of smart contracts and infrastructure, as well as the need for a comprehensive approach to security in the Web3 industry.

The Sui network’s response, which involved freezing a significant portion of the stolen assets, has sparked a heated debate in the crypto community. On the one hand, the swift intervention prevented further losses and recovered most of the funds, but on the other, it has called into question the principles of decentralization, prompting criticism for centralizing control and censoring transactions. This conflict reflects the difficult dilemma between the need to protect users and maintaining the openness and uncontrollability of blockchain networks.

In response to such incidents, the cryptocurrency industry is moving towards standardizing new security measures that include multi-layered protection, continuous monitoring, user education, and the introduction of innovative technologies such as artificial intelligence for proactive threat detection. Particular attention is being paid to multi-signature wallets, which are becoming the standard for managing large assets and corporate funds. Their distributed control, flexible signature schemes, and integration with hardware devices significantly increase resilience to attacks and minimize the risks of compromise.

Thus, the lessons learned from the Cetus hack and the reactions to it stimulate the development of more mature, comprehensive and balanced security strategies in Web3. They highlight that the success and trust of crypto ecosystems depend not only on technical innovation, but also on the ability to find harmony between decentralization and effective risk management. Only such an approach will allow the industry to develop sustainably and strengthen the trust of users and investors in the long term.