Two Sui wallet addresses belonging to the May 2025 Cetus protocol attacker were frozen by Sui validators and contain the majority of the stolen capital.

Quotes that support claims

There are two Sui wallet addresses of the attacker that were urgently blocked. The frozen wallets contain the main portion of the stolen capital

Once the vote surpassed 33% of the total stake, addresses that had drained around $162 million were effectively 'frozen,' Cetus said