Volo Protocol on Sui Exploited for $3.5 Million Across Multiple Vaults

Apr 22, 2026

Volo Protocol, a liquid staking platform on the Sui blockchain, suffered a security breach on Wednesday April 22, 2026, losing approximately $3.5 million from its WBTC, XAUm, and USDC vaults. The team responded by freezing all vaults and recovering $500,000 in assets through coordination with ecosystem partners, while pledging to absorb the full loss rather than pass it to users. The platform had $28 million in total value locked across unaffected vaults at the time of the exploit. The incident follows closely after the KelpDAO exploit over the weekend and contributes to the approximately $7.78 billion in total DeFi hacks recorded to date according to DeFiLlama data.

Volo Protocol exploit details and response

▪Volo Protocol froze all vaults in response to the security breach.
▪Volo Protocol froze $500,000 in assets through coordination with ecosystem partners following the exploit.
▪Volo Protocol stated it is prepared to absorb the financial loss rather than pass it on to users.
▪Volo Protocol is working with the Sui Foundation and onchain investigators to contain the damage and trace funds.
▪Volo Protocol confirmed the security breach early Wednesday on April 22, 2026.
▪Volo Protocol had approximately $28 million in total value locked across all other vaults that were not affected by the exploit.
▪Volo Protocol lost approximately $3.5 million from three vaults holding WBTC, XAUm, and USDC.
▪Volo Protocol is a platform built on the Sui blockchain where users deposit assets into yield-generating vaults.

Broader DeFi security crisis and mounting losses

▪Combined DeFi and bridge protocol losses exceed $10 billion, roughly equivalent to the market capitalization of cryptocurrencies ranked between 10th and 15th globally.
▪Bridge protocols have accounted for approximately $2.90 billion in losses.
▪Decentralized finance has suffered approximately $7.78 billion in hacks to date according to DeFiLlama data.

Recent context: KelpDAO breach and ripple effects

▪The Volo Protocol exploit occurred just days after the KelpDAO exploit that happened over the weekend.
▪The KelpDAO exploit triggered collateral damage in multiple DeFi protocols including lending platform Aave.
▪The KelpDAO attacker drained millions by artificially minting unbacked liquid restaking tokens called rsETH.

Perspective of Volo Protocol team

▪Volo Protocol's team pledged to absorb the $3.5 million loss rather than requiring affected users to bear the financial impact.
▪Volo Protocol is conducting an investigation into the security breach that affected its WBTC, XAUm, and USDC vaults.

Perspective of Volo Protocol users

▪Volo Protocol users with deposits in the unaffected vaults holding $28 million remain unable to access their funds during the freeze.
▪Volo Protocol users had their assets frozen across all vaults following the Wednesday security breach.