DeFi Protocol Loses $3.5 Million in Security Breach on Sui Blockchain

A decentralized finance protocol built on the Sui blockchain confirmed a security breach that drained roughly $3.5 million in digital assets from three vaults. The affected vaults held wrapped bitcoin (WBTC), tokenized gold token XAUm, and dollar-pegged stablecoin USDC.

Assets in other vaults remained unaffected. The protocol stated that the approximately $28 million in total value locked across all other vaults is safe. The exploit was isolated to the three specific vaults, with no shared attack vector identified for the remaining vaults.

The protocol announced it is prepared to absorb the financial loss rather than pass it on to users.

response to the breach, the protocol froze all vaults and began coordinating with the Sui Foundation and onchain investigators to trace the stolen funds. Since the incident, $500,000 in assets have been frozen through coordination with ecosystem partners, immobilizing those funds onchain to prevent movement or withdrawal.

The majority of the stolen funds remain under investigation. The protocol plans to publish a full post-mortem once the investigation is complete and remediation steps are finalized.

The breach occurred early on April 22, 2026, and follows a recent exploit at KelpDAO over the weekend, where an attacker drained millions by minting unbacked liquid restaking tokens. That incident affected multiple protocols, including lending platform Aave, where users withdrew funds due to heightened uncertainty.

According to data from DeFiLlama, decentralized finance has experienced roughly $7.78 billion in losses from hacks, with bridge protocols accounting for an additional $2.90 billion. The combined total exceeds $10 billion.