Volo

What happened

Sui liquid staking protocol Volo lost about $3.5 million from three vaults (WBTC, XAUm and USDC) on 21 April 2026 after a privileged admin key was compromised.

GoPlus Security and ExVul attributed the breach to a compromised operator key obtained through social engineering rather than any flaw in Volo's audited contracts. Volo self-disclosed within hours, froze the vaults, worked with the Sui Foundation, blocked a WBTC bridge attempt and clawed back around $2 million quickly; the team said it recovered nearly all funds, leaving a net loss of roughly $60,000, and absorbed user losses.