Another DeFi protocol loses millions in hack days after KelpDAO breach

Volo Protocol lost about $3.5 million from three vaults holding WBTC, XAUm, and USDC.

What to know:

• Volo Protocol was exploited, losing about $3.5 million from three vaults holding WBTC, XAUm, and USDC.
• The protocol froze all vaults, coordinated with the Sui Foundation, and says the remaining $28 million in funds are safe.
• The incident adds to a wider DeFi security problem, with over $10 billion in total crypto losses from hacks and bridge exploits to date.

Another day, another exploit. The security crisis in blockchain-based decentralized finance (DeFi), once touted as a challenger to legacy infrastructure, is only getting worse.

The latest victim is Volo Protocol, a platform built on the Sui blockchain, where users deposit assets into yield-generating “vaults," which function as pooled investments. Deposited tokens such as bitcoin, stablecoins and tokenized assets are deployed using various onchain strategies to generate returns.

Early Wednesday, the protocol confirmed a security breach that drained a total of roughly $3.5 million in digital assets from three of the vaults. Assets locked in other vaults were not affected, it said in a post on X.

"The ~$28M in TVL across all other Volo vaults is safe. The exploit was isolated to 3 specific vaults, and we have confirmed no shared attack vector exists with the remaining vaults," the protocol said, adding that it is “prepared to absorb” the financial loss rather than pass it on to users.

The attack hit vaults holding wrapped bitcoin (WBTC), Matridock's tokenized gold token, XAUm, and the dollar-pegged stablecoin USDC. In response, the protocol froze all vaults and began working with the Sui Foundation and onchain investigators to contain the damage and trace funds.

Since the incident, Volo has "frozen" $500,000 in assets through coordination with ecosystem partners, meaning those funds have been immobilized onchain to prevent any movement or withdrawal. Still, the majority of the stolen funds remain under investigation.

Growing unease

The breach adds to growing unease across decentralized finance, where a string of exploits has raised questions about smart contract security and protocol oversight. The timing is particularly sensitive, coming just days after the weekend's KelpDAO exploit, in which an attacker drained millions by artificially minting unbacked liquid restaking tokens, rsETH.

The aftermath has rippled across the DeFi, triggering collateral damage in multiple protocols, including leading lending platform Aave, where users rushed to withdraw funds because of the heightened uncertainty.

To date, decentralized finance has suffered roughly $7.78 billion in hacks, according to data from DeFiLlama. Bridge protocols — which enable the transfer of assets across blockchains — account for another $2.90 billion in losses. Combined, the figure exceeds $10 billion, roughly equivalent to the market capitalization of cryptocurrencies ranked between 10th and 15th globally.

Volo says it will publish a full post-mortem once its investigation is complete and remediation steps are finalized.

But for DeFi users and investors, a broader pattern is becoming harder to ignore: while institutional adoption is accelerating, relatively little of that capital appears to be flowing into improving security, with exploits continuing to arrive in clusters.

Read more: The $13 billion DeFi wipeout in two days, and it started with KelpDAO attack

More For You

Bitcoin's Coinbase premium has been positive for 14 straight days, the longest bullish streak since BTC hit its all time high of $126,000 in October.

What to know:

• Bitcoin's Coinbase premium has been positive for 14 straight days, the longest bullish streak since October 2025.
• The persistent positive reading points to a relatively stronger buying from U.S. investors.

Bitcoin's 'Coinbase premium' just posted its longest bullish streak since October's record high of $126,000

1 hour ago

Bitcoin climbs to $78,100 on Trump ceasefire extension, Strategy's $2.5 billion buy

2 hours ago

Tron's Justin Sun sues Trump-linked World Liberty Financial over frozen assets

2 hours ago

Chinese crypto mogul Li Lin’s private trading arm is set to move into a Hong Kong-listed wealth firm

2 hours ago

Crypto's great hope in Senate's Clarity Act still has a path to survive tight calendar

9 hours ago

Inside the hunt for Satoshi: Filmmakers chase crypto’s biggest mystery

10 hours ago

Crypto's massive exploit may force big banks to rethink their blockchain plans, Jefferies warns

13 hours ago

Strategy overtakes BlackRock IBIT in bitcoin holdings after bear market buying

22 hours ago

Kalshi takes on Coinbase, Robinhood with new plan to offer crypto perpetual futures: The Information

14 hours ago

North Korea’s crypto heist playbook is expanding and DeFi keeps getting hit

Apr 20, 2026

Aave’s core markets hit 100% utilization at once, and that's not a good thing

16 hours ago