The lending platform Scallop, based on the Sui blockchain, has been hacked. The perpetrators extracted approximately 150,000 SUI from the sSUI rewards pool.
✅ INCIDENT UPDATE
We have unfreezed the core contracts and all operations have resumed. The issue was not related to the core protocol and was isolated to a deprecated rewards contract.
User deposits were not impacted and all funds remain safe. Withdrawals and deposits are now…
— Scallop (@Scallop_io) April 26, 2026
The project team reported that the vulnerability was in a side smart contract that was no longer in use for core operations. The main protocol and user deposits were unaffected.
Developers temporarily suspended the platform’s operations for a security check. After some time, Scallop resumed normal operations. Users can now deposit and withdraw assets without hindrance.
Project representatives promised to fully compensate for the damage and cover 100% of the losses from their own funds. The team continues its investigation and has pledged to publish a detailed report later.
At the time of writing, Scallop’s total value locked amounts to $22.82 million.
The project’s native token SCA is trading at $0.017 (-2.5% over the day).
Earlier, on April 17, the liquid restaking protocol Kelp suffered a hack, resulting in a loss of approximately $293 million.
On April 22, attackers compromised the Volo platform and extracted $3.5 million from WBTC and USDC pools.