Volo Protocol, a liquidity staking protocol based on Sui, suffers targeted vault attack, losing approximately $3.5 million
Volo Protocol, a liquidity staking protocol based on Sui, suffered a targeted vault attack involving WBTC, XAUm, and USDC, resulting in losses of approximately $3.5 million. The team has urgently frozen the three affected vaults and successfully intercepted a cross-chain transfer of 19.6 WBTC, preserving about $500,000 in assets.
The project team stated that the current total locked value of approximately $28 million remains unaffected and promised to bear the losses themselves rather than passing them on to users. This incident follows the nearly $292 million attack on KelpDAO, which several blockchain analysis firms attributed to the North Korean Lazarus group, while Volo has not confirmed the identity of the attacker.
Source: Public information
ABAB AI Insight
This type of "self-bear loss" statement is essentially a compensatory action for DeFi protocols at the credit level. On-chain protocols lack traditional financial deposit insurance and lender-of-last-resort mechanisms; once a vulnerability occurs, the only means to stabilize user confidence is for the project team to bear the losses with their own assets. This indicates a shift from a "pure code system" to a "semi-credit intermediary," changing the risk structure.
The attack path focused on specific vaults and cross-chain segments, reflecting that the current weak points in DeFi security remain at the asset aggregation layer and bridging interfaces. Cross-chain assets (like WBTC) combined with derivative assets (XAUm) create complex combinations that amplify the attack surface. This structural complexity is essentially the cost of improving capital efficiency: higher returns, but a simultaneous increase in system vulnerability.
The series of large-scale attack incidents (including those linked to state-sponsored hackers) indicates that DeFi has entered a "confrontational security phase." Attackers are no longer individual hackers but organized, sustained coalitions of capital and technology. This will push the industry from a "rapid iteration priority" to a "security priority," leading to a repricing of development pace and capital allocation.
The Sui ecosystem is still in the early stages of expansion, and such events have limited impact on individual protocols, but they will marginally suppress capital inflow to the entire chain. Historically, emerging public chains often experience a path of "high returns attracting liquidity—security events clearing weak protocols—leading projects solidifying" in the early stages, and this incident is closer to the "risk exposure phase" in that cycle.