Sui-Based Volo Protocol Hit by $3.5M Exploit, Freezes Vol to Take Damage

An attempt to bridge at 19.6 WBTC was caught and blocked by the protocol, thus removing the assets from the attacker's control.

Volo Protocol, a liquidation platform built on the Sui network, has reported a security breach that resulted in a loss of nearly $3.5 million from its treasury, according to an official update shared by the group.

The exploit affected three vault holdings in WBTC, XAUm and USDC.

Recovery efforts have been intensified

In an official update, the protocol said it was aware of the attack and responded immediately by notifying the Sui Foundation and other ecosystem partners and freezing the affected vaults to prevent further losses. As part of the regulatory measures, all vaults have been temporarily suspended pending a full investigation and remediation process.

Volo confirmed that the vulnerability was isolated to the three stacked vaults with the remaining $28 million in total value locked intact and secure with no common attack vectors. The team announced that it is working with chain investigators and partners to recover the stolen funds and will conduct a detailed autopsy once the investigation is complete.

In subsequent updates, Volo reported that $500,000 worth of exploit-related assets had been frozen. Separately, the protocol said it successfully blocked an attacker's attempt to take 19.6 WBTC out of the hacker's control.

Volo added that he is working with ecosystem stakeholders to determine the appropriate process to return the stolen assets. It stated that the protocol is designed to absorb the financial losses and aims not to pass the results on to the users.

“We're in damage control mode right now, but once it's done, we'll work out a remediation plan, and we'll share a full breakdown soon.”

April DeFi exploitation wave

A series of major exploits hit DeFi platforms in April. For example, attackers withdrew about $285 million from the Solana-based Drift protocol in 12 minutes, and most of the funds were transferred to Ethereum a short time later. A chain movement related to the attack started in 2008. It's March 11th.

You may also like:

In a separate incident, the nearby protocol Rhea Financial lost an estimated $7.6 million after exploits. Meanwhile, KelpDAO suffered the biggest DeFi hack of the year. With the attackers who stole around 292 million dollars A cross-chain bridge built on LayerZero Labs infrastructure.