Volo Protocol, a liquid staking platform on Sui, said an attacker drained about $3.5 million from three of its vaults on Wednesday.
Inside the Volo Breach
The team disclosed the incident on X early Wednesday, noting that the stolen assets included Wrapped Bitcoin (WBTC), gold-backed XAUm, and USD Coin (USDC). Volo froze every vault and alerted the Sui Foundation.
Only three vaults were hit, the team said. The remaining $28 million in total value locked across other products does not share the same attack vector.
Volo launched as a dedicated SUI liquid staking service issuing the vSUI token, before being acquired by lending protocol NAVI in early 2024. The targeted vaults sat on top of that staking layer and accepted wrapped assets as collateral.
"Volo is prepared to absorb this loss," the team said, adding that a full post-mortem would follow once the internal review wraps up.
Also Read: $292M KelpDAO Hack Highlights Ethereum Weakness, Hoskinson Says
Brutal Month for DeFi
The Volo loss extends a punishing April for decentralized finance. Solana-based Drift Protocol lost roughly $285 million on Apr. 1, in what blockchain intelligence tied to a suspected North Korean operation.
Less than three weeks later, restaking protocol Kelp DAO was drained of about $292 million in restaked ether through a compromised bridge.
Sui has faced similar crises. Attackers exploited decentralized exchange Cetus for roughly $223 million in May 2025, though validators and the community eventually recovered most of those funds.
Read Next: CHIP Volume Now Outpaces Market Cap As Traders Pile In