Sui-Based Volo Hit by $3.5 Million Exploit as DeFi Faces Fresh Security Shock

• Volo said a $3.5 million exploit hit three isolated vaults involving WBTC, XAUm and USDC.
• The Sui-based protocol said about $28 million in total value locked across other vaults remains safe and that user losses will not be passed through.

Another week, another DeFi exploit. This time the damage landed on Volo, a liquid staking protocol built on Sui, which said an attack drained about $3.5 million from a limited part of its system.

In a statement posted on X on Wednesday, the team said the exploit affected select vaults holding assets including Wrapped Bitcoin, Matrixdock Gold XAUm and USDC. Volo said it detected the attack, notified the Sui Foundation and ecosystem partners, and froze the affected vaults to prevent further losses.

Volo says the damage was contained to three isolated vaults

The protocol’s first task now is to reassure users that the breach did not spread further. According to the team, roughly $28 million in TVL across other vaults remains safe, with the exploit limited to three isolated vaults and no shared vulnerability identified so far.

That detail matters. In DeFi, the first question after any exploit is rarely just how much was lost. It is whether the failure was local or systemic. Volo is clearly trying to signal the former.

The team also said it plans to absorb the losses itself rather than pass them on to users, though it has not yet finalized the remediation structure. That is not a trivial commitment, especially for a protocol of this size. It may help steady confidence in the short term, but it also raises the next obvious question, namely how the losses will actually be covered.

The exploit lands at a bad moment for DeFi

Timing, in this case, is part of the story. Volo’s hack arrives just days after Kelp was exploited for roughly $293 million, an event that has already rattled parts of the broader ecosystem and sharpened concerns around liquid staking and restaking infrastructure.

Volo itself operates in that same broad category. Users stake SUI and receive voloSUI (VSUI) in return, a model designed to keep capital productive while preserving liquidity.

That design has become popular across chains, but it also keeps drawing attackers toward the same pressure points. For now, Volo is arguing the blast radius was limited. Still, the larger pattern is harder to ignore. DeFi security is once again being tested not by theory, but by how many protocols can survive a week like this without users deciding they have seen enough.