Volo Claws Back Stolen Funds, Leaves Attacker With Almost Nothing

Volo recovers nearly all stolen assets after its $3.5M Sui vault exploit, cutting net losses to $60K. XAUm coordination with MatrixDock still ongoing.

Volo, the DeFi protocol on the Sui blockchain that suffered a $3.5 million vault exploit last week, said it has now recovered the remaining roughly 64.9 ETH the attacker obtained. The announcement came via @volo_sui on X, marking the protocol’s fifth recovery update.

Total net loss from the incident now stands at approximately $60,000.

The Attacker Identified, Funds Contained

That figure is a sharp drop from where this stood days earlier. As @volo_sui posted on X on April 25, the team had already recovered 90% of stolen assets by that point, converting them back to stablecoins and bridging them to Sui. The perpetrator had been identified.

The exploit had hit three vaults, pulling USDC, XAUm, and WBTC. Around half of the WBTC and XAUm holdings were swapped into USDC, bridged to Ethereum, then converted to ETH. That’s the standard playbook. Move it, shape-shift it, make it harder to trace.

Except it didn’t work.

Volo intercepted 19.6 WBTC on the LayerZero bridge before it cleared. Per the April 25 post on X, those funds have since been reappropriated in full on Ethereum. The Sui Foundation stepped in to unlock 100.6 XAUm, which returned to Volo’s custody.

One Vault Still Waiting

The XAUm piece is the last moving part. Not all of it, just one portion.

According to @volo_sui on X, the remaining 115 XAUm the attacker swapped on Sui is a different problem. Thin on-chain liquidity makes a DEX swap of that size unworkable. Volo said it is coordinating directly with @MatrixDock to acquire the amount. The XAUm vault restart will take longer than the others. No date given.

All other stolen vaults, the post confirmed, are ready to be replenished. They will be brought back online shortly.

Volo said it will cover the $60K out of its own treasury. Users will be made whole, no exceptions. The earlier update from April 25 had already committed to absorbing whatever the final loss figure came to, at the time still sitting near $200K.

The April 2026 crypto hack environment has been brutal by most measures, with total industry losses crossing $620 million across the month. Volo’s outcome sits differently against that backdrop. Most protocols in breach situations don’t recover 98% of what was taken.

The $60K is what’s left. The treasury is covering it.