Hacker Steals $223 Million From Crypto Platform Cetus

The company announced a $5 million bounty on the culprit and asked the hacker to cooperate to prevent further legal action.

A price chart on the Bybit website for the cryptocurrency Ethereum on a computer screen in New York City on Feb. 21, 2025. Patrick Sison/AP Photo

Decentralized cryptocurrency exchange Cetus suffered a security breach, with a threat actor successfully stealing $223 million from the platform, the company said in a May 22 post on social media platform X.

The affected funds are divided into two portions. One is stored within the Sui blockchain network on which Cetus operates, the company said in a May 25 update. That portion is worth about $162 million. Cetus has been successful in pausing these funds from being transferred further, it said in the May 22 post.

As such, the $162 million is now blocked from being transferred to accounts outside of the Sui network that are managed by the hacker. Cetus asked the Sui community to support a “protocol upgrade” so that the $162 million in frozen funds on the Sui network can be returned to its owners, the company said in a May 24 post.

“No one can make this decision unilaterally. We propose an on-chain vote involving the network’s major participants, including validators and SUI stakers, to decide on whether this upgrade is in the best interest of the Sui community. We want to recover and return the stolen funds, but we will respect whatever the community decides,” Cetus said.

The second portion of the funds, worth about $60 million, has been bridged out of the ecosystem and is mainly being held in the Ethereum blockchain.

Cetus said it was working “diligently” with security and analytics providers as well as law enforcement officials from across the world to recover the $60 million in stolen funds.

In a May 23 X post, the company announced a bounty of $5 million for information that leads to the identification and arrest of the hacker.

“We have not received any communication from the hacker. We encourage the hacker to sincerely consider our offer terms,” Cetus said. The company did not clarify what these terms are.

“If the hacker should cooperate and accept our offer as we hope, we will refrain from pursuing any further legal action or recourse, including the $5M bounty. The bounty is payable at Sui Foundation’s discretion.”

North Korean Crypto Hacks

Cetus is one of a number of crypto platforms to be targeted by hackers.

On May 15, cryptocurrency exchange Coinbase revealed it was targeted by hackers in a cyberattack that led to the theft of the personal data of thousands of customers.

The stolen info included names, phone numbers, addresses, emails, masked bank accounts, and government ID images such as of passports and driver’s licenses. The hackers tried to extort $20 million from the company, which Coinbase refused to pay.

Instead, Coinbase set up a $20 million reward fund for any information leading to the arrest and conviction of the hackers.

The hacking was facilitated by company insiders.

“The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access,” a company filing states.

Another major crypto breach took place in February, when Bybit, the second-largest crypto exchange in the world, revealed that a hack occurred when the company was conducting a routine crypto transfer.

Blockchain analysts tracked the attack to the Lazarus Group, a cybercrime gang reportedly operated by the North Korean communist regime.

Hackers from North Korea are a major presence in global crypto breaches. In a Dec. 19, 2024, report, blockchain analysis company Chainalysis said North Korean hackers stole more from crypto platforms in 2024 “than ever before.”

“U.S. and international officials have assessed that Pyongyang uses the crypto it steals to finance its weapons of mass destruction and ballistic missiles programs, endangering international security,” according to the report.

“In 2023, North Korea-affiliated hackers stole approximately $660.50 million across 20 incidents; in 2024, this number increased to $1.34 billion stolen across 47 incidents—a 102.88 percent increase in value stolen. These figures represent 61 percent of the total amount stolen for the year, and 20 percent of total incidents.”