Volo Protocol: The $3.5M Hack That Ended With $60K Lost

On the evening of 21 April 2026, before any security researcher or alert bot had noticed, Volo told its own users it had been robbed. About $3.5 million had been taken from three of its vaults on the Sui blockchain. "Volo is prepared to absorb this loss," the team wrote, which in decentralised finance is a sentence more often promised than kept.

A week later the loss stood at about $60,000, and Volo said it would pay that out of its own pocket. Most crypto hacks end with the money gone for good. This one ended with the thief left holding almost nothing.

The platform and the vaults

Volo is a liquid staking service on Sui, a blockchain launched in 2023 that competes with Ethereum and Solana. Staking means locking up a blockchain's coins to help run it in return for a yield, a little like a fixed-term deposit. Liquid staking hands the depositor a receipt token (on Volo it is called vSUI) that can still be traded or borrowed against while the original coins stay locked, rather like a bank certificate of deposit that can be sold on.

Over time Volo added vaults for other assets: pots of pooled money run by code that put deposits to work for a return. The three that were hit held WBTC (wrapped bitcoin, a token on another chain that tracks the price of one bitcoin), XAUm (a token issued by Matrixdock, each one backed by gold held in a vault) and USDC (a stablecoin, a digital dollar issued by Circle). Volo said about $28 million in its other vaults was untouched, and that it had found no weakness shared with them.

Volo had been running for more than two and a half years. Its code had been through three security audits and it ran a bug bounty on the HackenProof platform, paying outsiders to report flaws. None of that mattered, because the code was not what failed.

One key in the wrong hands

The security firm SlowMist classified the incident as a private key leak. A private key is the secret that signs transactions; whoever has it is, as far as the blockchain is concerned, the owner. In this case the key belonged to an admin account, the account allowed to manage the vaults. With it, the attacker could move the money out without breaking anything. Three other firms, GoPlus Security, ExVul and Bitslab, published their own on-chain analyses within 48 hours and reached the same conclusion: a compromised operator key, not a bug in the audited contracts.

How the key leaked has never been explained in public. Volo promised a full post-mortem; none had been published as of mid-October 2026.

The chase

The response was fast. Volo froze every vault and called the Sui Foundation, the non-profit that supports the Sui network. Less than 30 minutes after its first announcement it said about $500,000 of the stolen assets had already been frozen with the help of partners in the Sui ecosystem.

The thief tried to get the money off Sui, where it could be watched, and onto Ethereum, where it is easier to hide. Moving tokens between blockchains uses a bridge, a service that locks a token on one chain and issues a matching one on another, like changing money at an airport counter. About half of the stolen XAUm and WBTC was swapped into USDC. According to Rekt News, about $1.55 million of USDC went across to Ethereum in six transactions over roughly 80 minutes using Circle's own transfer service, and was then turned into ether (ETH).

The bitcoin did not make it. An attempt to send all 19.6 WBTC, about $2.1 million, across the LayerZero bridge was blocked, and the coins ended up held by ecosystem partners for Volo. The attacker's Ethereum address was flagged across most big exchanges and compliance tools, which made the rest hard to spend. Matrixdock, the gold token issuer, confirmed its physical gold reserves, audited by Bureau Veritas, were intact and froze the XAUm still sitting in the attacker's address.

Volo then posted a run of numbered recovery updates. By the third it said about $2 million had been frozen or blocked. By the fourth it said 90% of the stolen funds had been recovered in ETH, converted back to stablecoins and bridged home to Sui; 100.6 XAUm had been returned through the Sui Foundation; and the 115 XAUm the thief had already sold would be re-created through Matrixdock. Net loss at that point: about $200,000, to be covered from Volo's treasury.

Update five, posted on 28 April, said the last 64.9 ETH the attacker had acquired was also back. "With this recovery, our total net loss is now down to ~$60K," Volo wrote, adding that it would cover that itself so that no user lost anything. All vaults except the XAUm vault were ready to come back online. Volo never explained publicly how it got the ETH back from the attacker's wallets. Rekt News reported that the attacker had been identified, but no name has been published and no charge announced.

The month around it

Volo's neighbours on Sui held their breath. NAVI Protocol, a lending platform, paused its contracts as a precaution and reopened deposits and withdrawals about six and a half hours later; SuiLend said it was operating normally. There was no spillover.

The timing buried the story. On 1 April Drift Protocol, a trading platform on Solana, had lost about $295 million, and on 18 April Kelp DAO lost about $292 million through a bridge. TRM Labs, a blockchain analytics firm, linked both to North Korean hackers; LayerZero named the Lazarus Group for Kelp. CertiK put April's total losses at about $651 million, the worst month since March 2022 if February 2025, when the Bybit exchange lost $1.5 billion, is left aside. A $3.5 million hack with a happy ending did not make many front pages.

It deserves a place anyway, for two reasons. It shows how little an audit protects against a stolen key. And it shows what a recovery looks like when a team admits the loss within hours, a stablecoin issuer and a gold issuer can freeze tokens, and a bridge refuses to carry stolen coins.