finance
DeFi Protocol Loses $3.5 Million in Security Breach on Sui Blockchain
A decentralized finance protocol on the Sui blockchain suffered a security breach, resulting in the loss of approximately $3.5 million from three vaults. The protocol froze all vaults and coordinated with the Sui Foundation to contain the damage. The incident follows a recent exploit at KelpDAO and contributes to over $10 billion in total DeFi losses from hacks and bridge exploits.
Apr 22, 3:45 AM·1m read1 source
CoinDeskAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
A decentralized finance protocol built on the Sui blockchain confirmed a security breach that drained roughly $3.5 million in digital assets from three vaults. The affected vaults held wrapped bitcoin (WBTC), tokenized gold token XAUm, and dollar-pegged stablecoin USDC.
Assets in other vaults remained unaffected. The protocol stated that the approximately $28 million in total value locked across all other vaults is safe. The exploit was isolated to the three specific vaults, with no shared attack vector identified for the remaining vaults.
The protocol announced it is prepared to absorb the financial loss rather than pass it on to users.
response to the breach, the protocol froze all vaults and began coordinating with the Sui Foundation and onchain investigators to trace the stolen funds. Since the incident, $500,000 in assets have been frozen through coordination with ecosystem partners, immobilizing those funds onchain to prevent movement or withdrawal.
The majority of the stolen funds remain under investigation. The protocol plans to publish a full post-mortem once the investigation is complete and remediation steps are finalized.
The breach occurred early on April 22, 2026, and follows a recent exploit at KelpDAO over the weekend, where an attacker drained millions by minting unbacked liquid restaking tokens. That incident affected multiple protocols, including lending platform Aave, where users withdrew funds due to heightened uncertainty.
