Key conclusions
- Volo Protocol lost USD 3.5 million as a result of an attack on three vaults (WBTC, XAUm, USDC).
- The team declared to cover the losses from its own funds, protecting users’ capital.
- The total losses of the DeFi sector due to hacks and bridge errors have exceeded the USD 10 billion barrier.
The decentralized finance sector on the Sui blockchain is facing a serious crisis of confidence after Volo Protocol confirmed the theft of assets worth approximately $3.5 million. The incident, which occurred early Wednesday, directly affected three specific investment pools. The technical team immediately froze all operations in an effort to stem the capital outflow and secure the remaining $28 million locked in the protocol. This is the second such major hit to the DeFi ecosystem in recent days, which calls into question the effectiveness of smart contract audits in next-generation projects.
The course of the attack on Volo and the market reaction
The hackers focused their activities on three specific vaults where Wrapped Bitcoin (WBTC), tokenized Matridock gold (XAUm), and the USDC stablecoin were deposited. According to the official announcement published on the X website, the vulnerability did not affect other pools, which allowed to avoid a complete drain of liquidity. Volo has worked closely with the Sui Foundation and independent on-chain analysts to monitor the stolen funds.
🔒 Security Incident Update – Volo Protocol We want to address our community directly and transparently about a security incident that occurred earlier today. Rest assured, Volo is prepared to absorb any loss. What happened: An exploit resulted in the removal of approximately
The joint operation with ecosystem partners has already brought the first success in the form of blocking USD 500,000 on accounts associated with the attacker. Despite this, most of the capital still remains outside the control of developers. It is worth noting that the management board made an unusual decision to fully compensate the injured users from its own financial reserves. This move is aimed at saving the reputation of the brand, which has positioned itself as a safe alternative to traditional savings products.
Systemic security issues in Volo and KelpDAO
Data from DeFiLlama is merciless for the industry. Total losses resulting from exploits in the DeFi sector alone reached USD 7.78 billion, and if we include errors in cross-chain bridges, this amount increases to USD 10.68 billion. The scale of the phenomenon is already comparable to the market valuation of projects from the top fifteen largest cryptocurrencies in the world. Experts indicate that despite the inflow of institutional capital, expenditure on security infrastructure and continuous on-chain monitoring is still lagging behind the pace of implementation of new, risky functions intended to attract liquidity.
Do you currently have cryptocurrencies?
It’s about cryptocurrencies on an exchange, in an application or in a wallet. Don’t treat cryptocurrency ETFs, ETNs and ETPs as ownership.
The survey is anonymous and voluntary. We do not collect your name or IP address. We only publish data in aggregate. Privacy Policy
Volo’s future in the shadow of the sector’s billion-dollar losses
Volo Protocol is currently preparing a detailed post-mortem report to explain the exact mechanism of the exploit. For users, the key question remains about the stability of the model, in which an error in three pools forces the protocol to trigger rescue funds. Although the current situation appears to be under control and the remaining USD 28 million remains safe under the supervision of the Sui Foundation, trust in on-chain profit-generating systems has once again been put to a severe test.
The cryptocurrency market reacts to these reports with stoic calm, but inside the DeFi community it is seething. The repetition of attacks in such short periods of time suggests that hacker groups systematically test the resistance of newly created networks and protocols. Effective recovery of stolen funds still depends on the speed of centralized exchanges and stablecoin issuers, which can block hacker addresses at the request of law enforcement authorities. Until the full results of the investigation are published, all vaults remain closed to new deposits.
