Volo Protocol hit by $3.5M exploit, team absorbs loss

Volo Protocol, a liquid staking platform on the Sui blockchain, reported Tuesday that an exploit drained approximately $3.5 million from three vaults holding WBTC, XAUm and USDC. The team froze the affected vaults, notified the Sui Foundation and ecosystem partners, and recovered about $500,000 of the exploited assets.

The protocol posted an alert on X saying the attack targeted the WBTC, XAUm and USDC vaults and that all affected vaults will remain frozen while Volo completes a full post-mortem and implements remediation. Volo noted that its other vaults are not exposed to the same vulnerability and that those vaults hold about $28 million in total value locked.

Volo reported that less than 30 minutes after the initial announcement it had frozen roughly $500,000 of the assets taken in the exploit. The team has not disclosed the technical flaw that allowed the theft, and no suspect has been publicly identified. Volo did not provide a timetable for releasing a post-mortem or for reopening the frozen vaults.

Volo provides liquid staking services that let users lock assets to earn staking rewards while receiving a liquid token that represents the staked position. Liquid staking pools place user funds under smart contracts; correct contract logic and access controls are required to prevent unauthorized withdrawals.

On X the protocol wrote, “We want to be clear: Volo is prepared to absorb this loss. We will do our best not to pass this to our users.” The post added, “We understand that trust is earned, and right now, we are focused entirely on actions.”

The incident comes weeks after a separate $292 million exploit on a cross-chain bridge that investigators linked to the Lazarus hacking group. Volo said it will share investigation results and remediation steps once those processes are complete.