Hackers Breach Volo, Extract $3.5 Million from WBTC and USDC Pools

Hackers extracted $3.5 million from Volo's WBTC and USDC pools.

The Volo liquid staking protocol on the Sui blockchain has been breached, with attackers extracting approximately $3.5 million from the project’s pools.

🔒 Security Incident Update — Volo Protocol

We want to address our community directly and transparently about a security incident that occurred earlier today. Rest assured, Volo is prepared to absorb any loss.

What happened:

An exploit resulted in the removal of approximately…

— Volo (@volo_sui) April 21, 2026

The attack affected the WBTC, XAUm, and USDC vaults. Other asset pools, valued at $28 million, remained untouched. To halt the outflow of funds, developers froze the vulnerable smart contracts.

Project representatives stated that $500,000 has already been recovered with the support of the Sui Foundation and partners. Volo plans to cover the remaining losses from its own reserves.

The team is conducting an internal investigation in collaboration with on-chain analysts and is actively seeking the hackers. A detailed report on the incident and a compensation plan will be published later.

Earlier in April, hackers breached the ENS gateway eth.limo and cloud provider Vercel.

Subsequently, the Kelp liquid restaking protocol suffered a hack, resulting in a loss of approximately $293 million.