stable coins

Story: Volo Protocol Loses $3.5 Million in Vault Exploit, Team Pledges Full User Reimbursement

By Maheen Hernandez

1 / 15

Fast Freeze Stopped the Bleeding. The second Volo's team spotted the breach, they froze all vaults. Every single one.

2 / 15

Compensation Plan in the Works. Volo's preparing a compensation mechanism for users who lost funds.

3 / 15

Volo Protocol got hit hard. The liquid staking platform on Sui lost $3.5 million on April 22, 2026, when attackers drained three of its vaults holding WBTC, XAUm, and USDC.

4 / 15

It's the first major security mess for Volo since the platform went live 18 months back. The breach could've been worse—way worse.

5 / 15

Volo traced roughly $500,000 of the stolen crypto on-chain and managed to freeze it. They're working with ZachXBT, the on-chain sleuth who's tracked down plenty of stolen funds…

6 / 15

The second Volo's team spotted the breach, they froze all vaults. Every single one. That quick action kept the attackers from hitting more pools and draining additional funds.

7 / 15

SuiLend, another platform in the Sui ecosystem, confirmed it didn't see any problems on its end.

8 / 15

The attack vector? Volo's not saying yet. They're holding details close until they finish a full investigation and release a post-mortem report.

9 / 15

Volo's preparing a compensation mechanism for users who lost funds. Details aren't out yet because they're waiting on the final investigation report.

10 / 15

The Sui ecosystem crossed $1.2 billion in total value locked recently, and this breach is now part of the conversation about risks in that growing DeFi landscape.

11 / 15

See also: HackerOne Logs 85,000 Valid Bug Reports in 2025 as AI Tools Flood Platforms

12 / 15

Vault-specific architectures are supposed to limit risk by isolating assets. You put WBTC in one vault, USDC in another, and if one gets compromised, the others stay safe.

13 / 15

The $3.5 million loss isn't catastrophic for the protocol, but it's not pocket change either.

14 / 15

What caused the vulnerability? That's the big question. The post-mortem report should answer whether this was a coding mistake in Volo's smart contracts, something exploitable in…

15 / 15

Transparency matters a lot when things break. Volo's promising a detailed post-mortem, which is good because the DeFi community needs to understand what went wrong.

The Currency Analytics

Want the full story?