Sui-based Volo protocol loses $3.5 million after exploit

Sui-based Volo protocol loses $3.5 million after exploit
Volo Protocol loses $3.5M in hack

​The liquid staking protocol Volo, built on the Sui blockchain, suffered a security breach on Tuesday, resulting in the loss of approximately $3.5 million in assets. The attack targeted the protocol’s vaults holding WBTC, XAUm, and USDC.

Highlights

  • Volo Protocol lost approximately $3.5 million in a hack targeting WBTC, XAUm, and USDC vaults.
  • The team froze the affected vaults and recovered an additional $500,000 in misused funds.
  • Around $28 million in other vaults remains secure; Volo has committed to covering all losses itself.

Rapid response by the team

Volo quickly announced the incident on X and stated that it had immediately notified the Sui Foundation and ecosystem partners. The protocol froze the affected vaults to limit further damage and managed to freeze an additional $500,000 in misused funds less than 30 minutes after the initial disclosure.

In its statement, Volo emphasized that the remaining vaults were not vulnerable to the same exploit and remain secure. “Approximately $28 million held in other Volo vaults is safe,” the team said. The protocol also pledged to absorb the losses entirely and not pass them on to users. 

“We want to be clear: Volo is prepared to bear these losses. We will do everything possible to ensure they are not transferred to our users,” the statement read. 

In its latest update (Recovery Update #2), Volo announced another important development: the team successfully intercepted and blocked the hacker’s attempt to withdraw 19.6 WBTC. These funds are no longer under the hacker’s control. The protocol stated it will fully absorb the losses and will not pass them on to users.

All affected vaults will remain frozen until a complete investigation and recovery process is finished. The protocol has not yet disclosed the specific vulnerability or the identity of the attacker. 

Ongoing investigation

All affected vaults will remain frozen until a full investigation and recovery process is completed. Volo has not yet disclosed the specific vulnerability exploited or the identity of the attacker.

The incident occurred just days after the $292 million hack of the Kelp DAO bridge on LayerZero, which investigators linked to the North Korean hacking group Lazarus. The rapid succession of these high-profile exploits has once again highlighted security concerns within the DeFi sector.

Implications for Sui DeFi

While Volo responded swiftly and took full responsibility for the losses, the breach may still impact user confidence in liquid staking protocols on the Sui network. The incident adds to growing concerns about smart contract security on high-performance blockchains, even as the ecosystem continues to expand.

The team said it is now fully focused on the technical investigation and remediation efforts, promising a detailed post-mortem once the analysis is complete.

We also reported that Bitcoin surged above $78,000 as Trump extended the Iran ceasefire.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Weekly Top Bonuses
up to $2,500
deposit bonus for all clients
CLAIM BONUS
Your capital is at risk.