Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
The attack targeted WBTC, XAUm, and USDC▲$0.9999 vaults. The team has frozen the vulnerable contracts and blocked part of the stolen funds.
The team behind Volo, a <a href="https://xpertsstudio.com/building-a-decentralized-bank-for-micro-businesses-in-latin-america/” title=”Building a decentralized bank for micro businesses in Latin America”>decentralized liquid staking protocol on the Sui blockchain, has reported a hack. Attackers drained approximately $3.5 million from the WBTC, XAUm, and USDC vaults.
The remaining pools, holding $28 million in assets, remained untouched.
Hot topic:Bitcoin on April 22—BTC Approaches $78,300, Market Anticipates Short Squeeze
Developers immediately froze the vulnerable smart contracts and notified the Sui Foundation.
Shortly after the attack, the team, together with ecosystem partners, managed to block part of the stolen funds—approximately $500,000 in various assets. Additionally, the team intercepted 19.6 WBTC that the hacker attempted to withdraw through a cross-chain bridge. These funds are no longer under the attacker’s control.
- Volo to Cover Losses From Its Own Reserves
- Another Hack in a Difficult Month for DeFi
- What to Expect Next?
Volo to Cover Losses From Its Own Reserves
The protocol’s team stated that it is prepared to absorb the remaining losses itself and not pass them on to users.
“We understand that trust is earned through actions, not promises,” they noted.
All vaults remain frozen pending an internal investigation and the publication of a detailed post-mortem report. A compensation plan will be presented later.
Read also:Top 5 Crypto Liquidity Providers & Pools in 2026—Best Platforms for Trading Efficiency
The attack affected three vaults that accept wrapped assets and stablecoins as collateral for yield-generating strategies. Volo’s other products, including the vSUI liquid staking token, do not share a common vulnerability vector with the affected pools.
The protocol launched as a specialized platform for staking SUI▲$0.7718. In early 2024, lending protocol NAVI acquired it.
Another Hack in a Difficult Month for DeFi
The Volo incident follows a series of major exploits in April 2026. Earlier this month, the Solana-based Drift protocol lost approximately $285 million. Investigators from Elliptic linked that attack to suspected North Korean hackers.
Less than three weeks later, the Kelp DAO restaking protocol suffered a $292 million hackto possible involvement by the Lazarus Group
What to Expect Next?
Volo promises to cover losses without raising external funds. Depositors will watch closely when vaults reopen for withdrawals. The post-mortem report should clarify whether the vulnerability was isolated or systemic.
The investigation’s outcome could affect trust in Sui’s DeFi ecosystem. Sui’s total value locked exceeded $2.6 billion at the end of 2025, expanding the attack surface for malicious actors.
Source: bitcoinfoundation.org