TLDR
- Volo Protocol, a liquid staking platform on the Sui blockchain, was exploited for roughly $3.5 million
- The attack hit three vaults holding WBTC, XAUm, and USDC
- Volo froze $500,000 of the stolen assets within 30 minutes of the announcement
- The remaining $28 million in TVL across other vaults is reported to be safe
- Volo’s team has pledged to absorb the loss and not pass costs to users
Volo Protocol, a liquid staking platform built on the Sui blockchain, confirmed on April 21 that it had been exploited for approximately $3.5 million in user assets.
The attack targeted three of Volo’s vaults, which held Wrapped Bitcoin, a gold-backed token called XAUm, and USDC. The rest of the protocol’s vaults were not affected.
🔒 Security Incident Update – Volo Protocol
We want to address our community directly and transparently about a security incident that occurred earlier today. Rest assured, Volo is prepared to absorb any loss.
What happened:
An exploit resulted in the removal of approximately…
— Volo (@volo_sui) April 21, 2026
Volo announced the breach on X, saying it had immediately contacted the Sui Foundation and ecosystem partners after discovering the exploit. All vaults were frozen to stop further losses.
Within 30 minutes of the public announcement, Volo said it had managed to freeze $500,000 worth of the stolen assets. The team did not say how that freeze was achieved.
The protocol stated clearly that the remaining $28 million in total value locked across its other vaults was not at risk. Volo said those vaults do not share the same vulnerability.
Volo Pledges to Cover Losses
Volo’s team said it will absorb the full cost of the exploit and does not plan to pass any losses on to users. “We want to be clear: Volo is prepared to absorb this loss,” the team wrote on X.
The protocol has not yet disclosed the specific vulnerability that was exploited. The identity of the attacker has also not been revealed publicly.
Volo said all vaults will stay frozen until a full post-mortem is completed and a remediation plan is in place. The team is working with on-chain investigators to try to recover the remaining stolen funds.
The protocol emphasized that user trust is its priority. “We understand that trust is earned, and right now, we are focused entirely on actions,” Volo wrote.
A Pattern of Crypto Exploits
The Volo breach follows a much larger hack on Kelp DAO, a cross-chain bridge powered by LayerZero, which lost $292 million in a separate exploit.
Investigators have linked the Kelp DAO attack to North Korea’s Lazarus Group, a state-backed hacking organization known for targeting crypto platforms.
The Volo team has not suggested any connection between its exploit and the Kelp DAO incident.
Volo has not given a timeline for when vaults will be reopened. A full post-mortem report is expected once the investigation is complete.
The $500,000 in frozen assets remains the only portion of the stolen funds confirmed recovered so far.
