DeFi Protocol Scallop on Sui Hacked: 150,000 SUI Drained from Rewards Pool

What Happened

Scallop, a lending protocol built on the Sui blockchain, has fallen victim to a security exploit. Attackers identified a vulnerability in a deprecated rewards smart contract and drained approximately 150,000 SUI from the sSUI rewards pool.

The Scallop team responded promptly by temporarily freezing core contracts to conduct a thorough security review. Operations have since been fully restored.

"We have unfreezed the core contracts and all operations have resumed. The issue was not related to the core protocol and was isolated to a deprecated rewards contract. User deposits were not impacted and all funds remain safe. Withdrawals and deposits are now…" — Scallop (@Scallop_io), original post

Why This Matters

The Scallop exploit marks yet another entry in an alarming sequence of DeFi attacks in recent weeks. On April 17, liquid restaking protocol Kelp suffered a breach resulting in losses of roughly $293 million. On April 22, hackers compromised Volo and extracted $3.5 million from WBTC and USDC pools. This pattern of escalating exploits raises serious questions about the security posture of decentralized finance applications and could deter institutional capital from entering the space.

Exploit Details and Team Response

According to the development team, the exploit was confined to a peripheral rewards smart contract that was no longer actively used within the protocol's current architecture. The core lending logic and user deposits remained completely unaffected throughout the incident.

Scallop's team has committed to making all affected parties whole, pledging to reimburse 100% of the losses from the project's own reserves. An investigation into the full circumstances of the breach is ongoing, with a detailed post-mortem report expected at a later date.

Users can currently deposit and withdraw assets from the platform without any restrictions.

Current State of the Project

Scallop's total value locked (TVL) stands at $22.82 million according to DefiLlama at the time of the incident. The project's native token SCA is trading at $0.017, down 2.5% over the past 24 hours per CoinGecko data.

While the scale of losses is relatively modest compared to recent high-profile DeFi breaches, the attack highlights a persistent risk: deprecated and unused smart contract components left on-chain can serve as viable attack vectors. Even code that has been retired from active use retains its on-chain presence and potential vulnerabilities, underscoring the importance of comprehensive contract lifecycle management in DeFi protocols.