DeFi Protocol Volo Loses Millions to Hackers Just Days After KelpDAO Breach

The decentralized finance sector is facing a deepening security crisis, with Volo Protocol being the latest to fall victim to a major hack. This platform, which operates on the Sui blockchain, allows users to deposit assets into yield-generating 'vaults' that function as pooled investments. These deposited tokens, including bitcoin, stablecoins, and tokenized assets, are utilized through various on-chain strategies to generate returns. On Wednesday, Volo Protocol confirmed that it had suffered a security breach, resulting in the loss of roughly $3.5 million in digital assets from three of its vaults. Fortunately, assets in other vaults were not affected, as stated by the protocol in a post. The breach was isolated to three specific vaults, and the protocol has confirmed that there is no shared attack vector with the remaining vaults. As a result, the protocol has decided to absorb the financial loss rather than passing it on to its users. The hack targeted vaults containing wrapped bitcoin (WBTC), XAUm (a tokenized gold token), and the dollar-pegged stablecoin USDC. In response to the incident, Volo Protocol froze all its vaults and collaborated with the Sui Foundation and on-chain investigators to mitigate the damage and track the stolen funds. Through coordination with ecosystem partners, Volo has successfully 'frozen' $500,000 in assets, immobilizing these funds on-chain to prevent any movement or withdrawal. However, the majority of the stolen funds remain under investigation. This breach has added to the growing concerns across the decentralized finance sector, where a series of exploits has raised questions about the security of smart contracts and protocol oversight. The timing of this incident is particularly sensitive, coming just days after the KelpDAO exploit, in which an attacker drained millions by artificially minting unbacked liquid restaking tokens. The aftermath of the KelpDAO exploit has had a ripple effect across the DeFi sector, causing collateral damage in multiple protocols, including the leading lending platform Aave. Users have rushed to withdraw their funds due to the heightened uncertainty. According to data from DeFiLlama, decentralized finance has suffered approximately $7.78 billion in hacks to date. Bridge protocols, which facilitate the transfer of assets across blockchains, account for an additional $2.90 billion in losses. The combined figure exceeds $10 billion, roughly equivalent to the market capitalization of cryptocurrencies ranked between 10th and 15th globally. Volo Protocol has announced that it will publish a full post-mortem once its investigation is complete and remediation steps are finalized. However, for DeFi users and investors, a broader pattern is becoming increasingly difficult to ignore: despite accelerating institutional adoption, relatively little capital appears to be allocated towards improving security, with exploits continuing to occur in clusters.