Gate News message, April 26 — Scallop Protocol, a lending platform on the Sui blockchain, suffered a flash loan exploit targeting a deprecated side contract linked to its sSUI rewards pool, resulting in a loss of approximately $142,000 (150,000 SUI). The attack exploited oracle price feed manipulation to artificially depress SUI/USDC exchange rates and borrow assets at distorted prices, with the attacker repaying the flash loan within the same transaction and pocketing the difference.
The core issue stemmed from a deprecated V2 contract deployed in November 2023 that remained callable on-chain. In this outdated contract, a critical variable called “last_index” was never initialized when new accounts were created. This flaw allowed the attacker to claim rewards as if they had been staking since the pool’s inception. With the reward index having grown to 1.19 billion over 20 months, the attacker staked 136,000 sSUI but received credit for 162 trillion points. Since the rewards pool operated at a 1:1 exchange rate, these points converted directly to 162,000 SUI worth of rewards. The pool contained only 150,000 SUI, and all funds were drained. On-chain data shows the stolen funds were quickly routed through a mixing service, complicating recovery efforts.
Scallop’s team responded by temporarily pausing operations before unfreezing core contracts and resuming all operations. The protocol confirmed that the exploit was isolated to the deprecated rewards contract and did not affect the core protocol or user deposits, with all funds remaining safe. The attacker subsequently contacted the team offering to return 80% of the stolen funds in exchange for a white-hat bounty, and the incident is now under investigation. The team will review how the flaw escaped detection during prior audits by firms including OtherSec and MoveBit.
SUI price remained resilient following the exploit, rising approximately 2% in the 24 hours following the attack and trading at $0.94 with a daily trading volume of around $187 million. The incident reflects a broader trend in April 2026, where major DeFi exploits have targeted deprecated contracts and infrastructure layers rather than core protocol logic, with cumulative losses exceeding $600 million across 12 major incidents during the month.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
22-Year-Old Sentenced to 70 Months for $263 Million Crypto Theft Money Laundering
California resident Evan Tangeman, 22, was sentenced on Friday to 70 months in federal prison for his role laundering proceeds from a multi-state cryptocurrency theft ring that stole approximately $263 million in digital assets from victims, according to the U.S. Department of Justice. U.S.
CryptoFrontier2h ago
Litecoin Suffers Deep Chain Reorganization After MWEB Privacy Layer Zero-Day Exploit
Gate News message, April 26 — Litecoin underwent a deep chain reorganization on Saturday afternoon after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according
GateNews3h ago
Address Linked to Avi Eisenberg Shows New On-Chain Activity, Raising Security Concerns
Gate News message, April 26 — Blockchain analytics platform Arkham has identified renewed on-chain activity from an address believed to be connected to Avi Eisenberg, the attacker who profited approximately $110 million from the 2022 Mango Markets exploit. Eisenberg was previously sentenced to
GateNews5h ago
Sui DeFi lending protocol Scallop is hacked, with a vulnerability in the old contract leading to 150k SUI stolen
Scallop was attacked on the Sui chain, and the side contract involved led to the sSUI rewards pool being exploited. Approximately 150k SUI were stolen. The core contract is secure, and deposits and withdrawals have been restored. The official statement applies only to the deprecated rewards contract; users’ funds were not affected. Former NEAR developer Vadim said the vulnerability originated from an outdated V2 package from 17 months ago, where not initializing last_index caused rewards to accumulate starting in 2023. The fix requires adding a version field to the shared object and strengthening version checks to prevent risks caused by outdated packages.
ChainNewsAbmedia5h ago
Scallop Discovers sSUI Reward Pool Vulnerability, Suffers 150K SUI Loss but Pledges Full Reimbursement
Gate News message, April 26 — Scallop, a lending protocol in the Sui ecosystem, announced the discovery of a vulnerability in an auxiliary contract associated with its sSUI reward pool, resulting in a loss of approximately 150,000 SUI. The affected contract has been frozen, and Scallop confirmed
GateNews10h ago
Litecoin Undergoes Deep Chain Reorganization After MWEB Privacy Layer Zero-Day Exploit
Gate News message, April 26 — Litecoin experienced a deep chain reorganization on Saturday (April 26) after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The reorg spanned blocks 3,095,930 to 3,095,943 and
GateNews11h ago
