Volo Protocol on Sui Hacked for $3.5M from WBTC and USDC Pools
Hackers exploited a vulnerability in the Volo liquid staking protocol on Sui, draining approximately $3.5M from WBTC, XAUm, and USDC vaults. The team has frozen contracts and recovered part of the stolen funds.
Volo, a liquid staking protocol built on the Sui blockchain, was hit by a cyberattack on April 21. The attackers managed to drain approximately $3.5 million from several of the project's liquidity pools.
What Happened
The exploit targeted Volo's WBTC, XAUm, and USDC vaults. Other pools holding a combined $28 million in assets were not affected. Developers moved quickly to freeze the vulnerable smart contracts and halt further outflows.
The Volo team acknowledged the breach publicly:
"🔒 Security Incident Update — Volo Protocol. We want to address our community directly and transparently about a security incident that occurred earlier today. Rest assured, Volo is prepared to absorb any loss. What happened: An exploit resulted in the removal of approximately…" — Volo (@volo_sui), original post
Recovery Efforts
Working alongside Sui Foundation and ecosystem partners, the Volo team managed to block a portion of the stolen assets. So far, 19.6 WBTC has been intercepted as the hacker attempted to move them through a cross-chain bridge. An additional ~$500,000 in other tokens has also been frozen.
The project has committed to covering remaining losses from its own reserves. An internal investigation is underway with on-chain analysts working to identify the perpetrators. A detailed incident report and a fund reimbursement plan will be published at a later date, according to the team.
Why This Matters
The Volo breach marks another major DeFi security incident in April 2026. Earlier this month, the ENS gateway eth.limo and cloud provider Vercel were both compromised. The liquid restaking protocol Kelp also suffered a devastating attack that resulted in the loss of roughly $293 million.
This wave of high-profile hacks raises continued concerns about the security of DeFi protocols, particularly those interfacing with cross-chain infrastructure. While Volo's swift coordination with Sui Foundation and the successful freezing of a significant portion of the stolen funds show improvement in incident response capabilities, the exploit itself underscores persistent smart contract vulnerabilities across the ecosystem.
The situation remains ongoing as the community awaits Volo's full post-mortem report.
Frequently Asked Questions
How much was stolen in the Volo protocol hack?
Hackers drained approximately $3.5 million from Volo's WBTC, XAUm, and USDC vaults. Other pools holding $28 million in assets were unaffected by the exploit.
Has Volo recovered any of the stolen funds?
Yes, the team intercepted 19.6 WBTC that the hacker attempted to move via a cross-chain bridge. An additional ~$500,000 in other assets was also frozen. Volo has pledged to cover remaining losses from its own reserves.
What is Volo Protocol on Sui?
Volo is a liquid staking protocol operating on the Sui blockchain. It allows users to stake assets while maintaining liquidity through derivative tokens. The protocol held approximately $31.5 million in total assets at the time of the attack.
Is the Sui blockchain itself compromised after the Volo hack?
The Sui blockchain itself was not compromised. The exploit targeted vulnerabilities in Volo's specific smart contracts. Sui Foundation assisted in freezing part of the stolen funds in coordination with the Volo team.
Read also
Drift Protocol Hack Victims File Class Action Lawsuit Against Circle Over $230M in USDC
Over 100 victims of the Drift Protocol exploit have filed a class action lawsuit against Circle in Massachusetts court, accusing the USDC issuer of negligence and enabling hackers.
Drift Protocol on Solana Hacked for $280M in Sophisticated Durable Nonce Attack
Solana-based DeFi platform Drift Protocol lost at least $280 million in a hack on April 1. The DRIFT token dropped 37% while Circle faces criticism for failing to freeze stolen USDC.
Stablecoin Transfer Volume Hits $10.5 Trillion in January — Highest Since April 2022
January stablecoin transaction volume surpassed $10.5 trillion, marking the highest monthly figure since April 2022. USDC led transfers while USDT maintained market cap dominance.
Top 10 Dollar Stablecoins in 2026: From Dominant Players to Exit Candidates
The stablecoin market has surpassed $311 billion in total capitalization. Here's a breakdown of the ten largest USD-pegged stablecoins — from undisputed leaders Tether and Circle to ambitious newcomers.
TON Wallet Introduces Yield Vaults for BTC, ETH, and USDT Directly in Telegram
TON Wallet has launched yield vaults for BTC, ETH, and USDT directly within Telegram, offering up to 18% APY on stablecoins through partnerships with Morpho, TAC, and Re7.
Weekly Recap: Aave Ecosystem Rescue Mobilizes 100,000 ETH and Quantum Computer Cracks 15-Bit ECC Key
Bitcoin held near $78,000, the DeFi community rallied over 100,000 ETH to help Aave recover from the Kelp hack, and a researcher cracked a 15-bit ECC key on a quantum computer.