On April 21, 2026, Volo Protocol on Sui was exploited when a high-privilege admin key was compromised, likely via social engineering. The attacker drained three vaults: WBTC (~$2.1M), XAUm (~$0.9M), and USDC (~$0.5M). The team recovered ~$3.44M (90%) of funds after blocking a $500K bridge attempt.