Volo (@Volo_sui), A Liquid Staking Platform Built On The Sui Blockchain, Was Exploited For Approximately $3.5 Million On Tuesday After Attackers Gained Access To Private Keys Controlling Three Vaults Holding $Wbtc, Matrixdock'S $Xaum Gold Token, And $Usdc.

The team said it has since recovered around $2 million of the stolen funds, including blocking a transfer of 19.6 $WBTC across a bridge and freezing roughly $500,000 in coordination with the Sui Foundation and ecosystem partners. The remaining exposure stands at approximately $1.5 million.

In a Community Status Report published Tuesday evening, Volo attributed the breach to a private key compromise rather than a flaw in its smart contracts or underlying protocol. The team stated that the Sui blockchain and its infrastructure performed as intended throughout the incident. Volo added that it is "fully prepared to make every affected user whole" for outstanding losses and will release a full technical post-mortem once its investigation is complete.

Around $28 million in total value locked across Volo's other vaults remains unaffected, with no shared attack vector identified between the compromised vaults and the rest of the protocol.

The incident adds to a growing tally of losses across the crypto industry this month. The Volo exploit follows LayerZero's $292 million $rsETH bridge incident and pushes total April 2026 crypto exploit losses past $606 million in just 18 days, putting it on course to be the worst single month for hacks since the Bybit breach in February 2025.