Sui-based liquid staking platform Volo Protocol said on Wednesday that an attacker drained roughly $3.5 million from three of its vaults, the latest DeFi security breach in a month already shaken by nine-figure exploits.
Volo froze every vault after detecting the attack and notified the Sui Foundation. The stolen assets included Wrapped Bitcoin (WBTC), gold-backed XAUm, and USD Coin (USDC). The team said the remaining $28 million in total value locked across other vaults carries no shared attack vector.
Volo described the breach as a security incident in a statement posted on X early Wednesday. Only three vaults were affected, and the team said no other part of the protocol shares the same vulnerability.
The project is working with on-chain investigators and ecosystem partners to trace and recover the stolen funds. A full post-mortem will follow once the internal review concludes.
Volo originally launched as a dedicated SUI liquid staking platform, issuing the Volo Staked SUI (vSUI) token, before being acquired by Sui lending protocol NAVI in early 2024. The vault products targeted in this incident sit on top of that staking layer and accept wrapped assets and stablecoins as collateral for yield strategies.
Volo also moved to reassure users that any losses would not be passed on.
The protocol said a remediation plan would follow once damage control operations finish, adding that rebuilding user trust depends on actions rather than promises.
Volo's loss follows a string of major April incidents that have battered decentralized finance. Solana-based Drift Protocol lost about $285 million on April 1, in what Elliptic has linked to a suspected North Korean infiltration operation.
Less than three weeks later, restaking protocol Kelp DAO was drained of 116,500 restaked ether (rsETH) worth roughly $292 million through a compromised LayerZero bridge. Ethereum DeFi has since lost more than 17% of its total value locked.