Volo Protocol Loses $3.5 Million in Sui Vault Exploit Amid DeFi Hack Streak

Sui-based liquid staking platform Volo Protocol said on Wednesday that an attacker drained roughly $3.5 million from three of its vaults, the latest DeFi security breach in a month already shaken by nine-figure exploits.

Volo froze every vault after detecting the attack and notified the Sui Foundation. The stolen assets included Wrapped Bitcoin (WBTC), gold-backed XAUm, and USD Coin (USDC). The team said the remaining $28 million in total value locked across other vaults carries no shared attack vector.

Inside the Volo Protocol Exploit

Volo described the breach as a security incident in a statement posted on X early Wednesday. Only three vaults were affected, and the team said no other part of the protocol shares the same vulnerability.

The project is working with on-chain investigators and ecosystem partners to trace and recover the stolen funds. A full post-mortem will follow once the internal review concludes.

Volo originally launched as a dedicated SUI liquid staking platform, issuing the Volo Staked SUI (vSUI) token, before being acquired by Sui lending protocol NAVI in early 2024. The vault products targeted in this incident sit on top of that staking layer and accept wrapped assets and stablecoins as collateral for yield strategies.

Volo also moved to reassure users that any losses would not be passed on.

“Volo is prepared to absorb this loss. We will do our best not to pass this to our users,” Volo team, said.

The protocol said a remediation plan would follow once damage control operations finish, adding that rebuilding user trust depends on actions rather than promises.

Latest Hit in a Brutal Month for DeFi

Volo’s loss follows a string of major April incidents that have battered decentralized finance. Solana-based Drift Protocol lost about $285 million on April 1, in what Elliptic has linked to a suspected North Korean infiltration operation.

Less than three weeks later, restaking protocol Kelp DAO was drained of 116,500 restaked ether (rsETH) worth roughly $292 million through a compromised LayerZero bridge. Ethereum DeFi has since lost more than 17% of its total value locked.

Balancer also lost more than $128 million to an exploit earlier in the year. A targeted wallet drain cost one individual investor over $280 million across Ethereum and Arbitrum.

The Sui ecosystem has faced similar crises before. Attackers exploited the Cetus exchange for about 223 million dollars in May 2025. A flaw in concentrated liquidity pools enabled the attack. Sui validators and the community recovered most stolen funds. Total value locked on Sui exceeded 2.6 billion dollars in late 2025. This growth expanded the attack surface for exploiters. Attackers now target vault logic and oracle dependencies more often.

Volo promises to cover the 3.5 million dollar loss without external help. Depositors will watch closely when withdrawals reopen. The post-mortem should clarify the root cause. It will show whether the flaw was isolated or systemic. The findings may impact trust in the Sui DeFi ecosystem.