The Volo protocol for liquid staking on the Sui blockchain has been hacked, with attackers withdrawing around $3.5 million from the project's pools.
🔒 Security Incident Update — Volo Protocol
— Volo (@volo_sui) April 21, 2026
We want to address our community directly and transparently about a security incident that occurred earlier today. Rest assured, Volo is prepared to absorb any loss.
What happened:
An exploit resulted in the removal of approximately…
The attack affected the WBTC, XAUm, and USDC reserves. Other pools holding $28 million in assets were not impacted. To halt the outflow of funds, developers froze the vulnerable smart contracts.
In collaboration with the Sui Foundation and ecosystem partners, they managed to block a portion of the stolen funds. Currently, the team has intercepted 19.6 WBTC that the hacker attempted to withdraw via a cross-chain bridge. An additional $500,000 in other assets has also been successfully frozen.
Volo plans to cover the remaining losses using its own reserves.
The team is conducting an internal investigation alongside on-chain analysts to track down the hackers. A detailed report on the incident and a reimbursement plan will be published later.
Recall that in April, hackers breached the ENS gateway eth.limo and the cloud provider Vercel.
Later, the liquid restaking protocol Kelp was also attacked, resulting in a loss of approximately $293 million.