Sui liquid-staking protocol Volo hit by $3.5M drain, freezes affected vaults, recovers $500K and vows to reimburse users

Volo Protocol, a DeFi/liquid-staking platform on the Sui blockchain, suffered a security breach on April 21 that allowed attackers to drain roughly $3.5 million from three vaults (WBTC, XAUm and USDC); the protocol froze the affected vaults after detecting the exploit ^{[1] [2] [3] [4]}.

The team reports it was able to freeze or recover about $500,000 of the stolen funds and has pledged to absorb all user losses so customers will not be impacted; the protocol says its other vaults, which hold roughly $28 million in total value locked, remain secure ^{[3] [1] [2]}.

Volo has committed to covering user losses and has frozen the compromised vaults while addressing the incident; the situation remains developing and the team has indicated it will update users as it works through remediation ^{[2] [3]}.