Back Panewslab

Scallop: Lost 150000 SUI due to a vulnerability in the sSUI reward pool, will fully bear the loss.

Panewslab • April 27, 2026

PANews reported on April 26 that Scallop, the lending protocol within the Sui ecosystem, announced on its X platform that a vulnerability was discovered in an affiliate contract related to Scallop's sSUI reward pool, resulting in a loss of approximately 150,000 SUI. The affected contract has been frozen. Scallop stated that the core contract remains secure, and only the sSUI reward pool was affected. All other reward pools are safe. Scallop will fully assume 100% of the loss and will release further updates as soon as possible.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Scallop Protocol Exploit Drains 150K SUI Due to Deprecated Contract Vulnerability On April 26, 2026, the Scallop Protocol, a DeFi platform on the Sui Network, suffered an exploit that drained approximately 150,000 SUI tokens from its sSUI rewards pool. The attacker targeted a deprecated V2 contract from November 2023, exploiting an uninitialized variable called 'last_index' which allowed them to claim rewards without prior staking. The exploit resulted in the attacker generating around 162 trillion reward points, which were converted to SUI tokens at a 1:1 ratio, leading to the total depletion of the rewards pool. Scallop's team acted quickly to freeze the affected contract and confirmed that the core protocol remained secure. They will cover the loss entirely from their treasury, ensuring no user yields will be diluted. The incident highlights the risks associated with immutable smart contracts and the need for version control. The attacker has since offered to return 80% of the stolen funds for a white-hat bounty. A full audit of legacy contracts is planned. 4 sources 69

Scallop: Lost 150000 SUI due to a vulnerability in the sSUI reward pool, will fully bear the loss.

The full story

Extracted Entities

Companies (1)

Platforms (1)