Volo Protocol — Sui Vault Admin Key Compromise

Timeline: On 21 April 2026, an exploit hit Volo Protocol's vault contract (BTCFi + liquid staking) on Sui. Root cause confirmed by GoPlus Security, ExVul, Bitslab: high-privilege operator key compromise (not a smart contract flaw — Volo had been audited by Ottersec, Movebit, Hacken, with active bug bounty). 3 vaults drained: WBTC (~$2.1M, 19.6 WBTC), XAUm (~$0.9M), USDC (~$0.5M) — total ~$3.5M. The team quickly detected the breach, paused all vaults, notified the Sui Foundation and engaged on-chain investigators + ecosystem partners. Within 30 minutes: ~$500K frozen via partner coordination. On 22 April 2026, Volo intercepted and blocked the bridge attempt for the remaining 19.6 WBTC (~$2.1M); these funds are under ecosystem partner control (in process of return to the protocol). Volo publicly committed: 'Volo is prepared to absorb this loss. We will do our best not to pass this to our users'. All vaults remain frozen pending full post-mortem. Incident came 3 days after the Kelp DAO hack ($292M). Operator key compromise on a protocol audited by Ottersec + Movebit + Hacken: audits ≠ key management hygiene.