What happened
On April 21, 2026, Volo lost about $3.5 million from three isolated Sui vaults holding WBTC, XAUm, and USDC. Volo froze the vaults and said its other vaults were unaffected.
Technical root cause
Preliminary reporting attributed the breach to a compromised privileged vault administrator key rather than a flaw identified in Volo’s audited smart-contract code.
Protocol details
Security review history
- Hacken View report
- MoveBit View report
- Veridise View report
Evidence
- report @volo_sui incident report x.com
- report Post-mortem rekt.news
- report Volo incident reporting cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Volo vault incident analysis news.bitcoin.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
