Volo Protocol, a liquid staking platform built on Sui, said it suffered an exploit that drained about $3.5 million from several vaults

Summary

• Volo Protocol said attackers drained $3.5 million from WBTC, XAUm and USDC vaults on Sui.
• The team froze affected vaults and later said it had secured $500,000 in assets.
• Volo said it plans to absorb losses and avoid passing the exploit cost to users.

The team said the attack affected its WBTC, XAUm, and USDC vaults. The protocol said it moved quickly after detecting the issue. It notified the Sui Foundation and ecosystem partners and froze the affected vaults to limit further losses.

Meanwhile, Volo said the exploit targeted assets held in its WBTC, XAUm, and USDC vaults. The team did not disclose the technical cause of the incident or identify any suspected attacker.

In its public statement, the project said all vaults would remain frozen until a full post-mortem and remediation process is complete. The team also said the weakness did not affect the rest of the protocol’s products.

Volo stated that around $28 million in total value locked across its other vaults remains safe. The platform said those vaults do not share the same vulnerability seen in the exploited ones.

The team used social media to update users as the situation developed. It said the main focus was to contain the damage and protect remaining assets.

Team says users will not bear the loss

Volo said it plans to absorb the loss rather than pass it on to users. In its statement, the team wrote, “We want to be clear: Volo is prepared to absorb this loss. We will do our best not to pass this to our users.”

That message came as users looked for clarity on how the platform would respond. The team said trust must be earned and that its response would focus on action.

Volo later added that it had frozen $500,000 in exploited assets less than 30 minutes after its first announcement. The recovery effort is still ongoing, and the team has not shared further details on asset tracing.

The protocol has not yet released a timeline for reopening the affected vaults. It said the freeze will stay in place until the review is complete.

Incident follows another major DeFi exploit

The Volo exploit came shortly after another large attack in the crypto sector. It followed the $292 millionexploit involving Kelp DAO, a LayerZero-powered cross-chain bridge.

Investigators linked that earlier case to North Korea’s Lazarus Group. Volo has not connected its own exploit to any known actor at this stage.