Gate News message, April 26 — Scallop Protocol, a lending platform on the Sui blockchain, suffered a flash loan exploit targeting a deprecated side contract linked to its sSUI rewards pool, resulting in a loss of approximately $142,000 (150,000 SUI). The attack exploited oracle price feed manipulation to artificially depress SUI/USDC exchange rates and borrow assets at distorted prices, with the attacker repaying the flash loan within the same transaction and pocketing the difference.
The core issue stemmed from a deprecated V2 contract deployed in November 2023 that remained callable on-chain. In this outdated contract, a critical variable called “last_index” was never initialized when new accounts were created. This flaw allowed the attacker to claim rewards as if they had been staking since the pool’s inception. With the reward index having grown to 1.19 billion over 20 months, the attacker staked 136,000 sSUI but received credit for 162 trillion points. Since the rewards pool operated at a 1:1 exchange rate, these points converted directly to 162,000 SUI worth of rewards. The pool contained only 150,000 SUI, and all funds were drained. On-chain data shows the stolen funds were quickly routed through a mixing service, complicating recovery efforts.
Scallop’s team responded by temporarily pausing operations before unfreezing core contracts and resuming all operations. The protocol confirmed that the exploit was isolated to the deprecated rewards contract and did not affect the core protocol or user deposits, with all funds remaining safe. The attacker subsequently contacted the team offering to return 80% of the stolen funds in exchange for a white-hat bounty, and the incident is now under investigation. The team will review how the flaw escaped detection during prior audits by firms including OtherSec and MoveBit.
SUI price remained resilient following the exploit, rising approximately 2% in the 24 hours following the attack and trading at $0.94 with a daily trading volume of around $187 million. The incident reflects a broader trend in April 2026, where major DeFi exploits have targeted deprecated contracts and infrastructure layers rather than core protocol logic, with cumulative losses exceeding $600 million across 12 major incidents during the month.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
RAVE Token Surges 110x in Two Weeks, Then Crashes 98% Amid Market Manipulation Allegations
Gate News message, April 27 — RAVE, the native token of RaveDAO (a Web3-based cultural community project), skyrocketed 110x in two weeks before plummeting 98% over two days on April 19-20, prompting comparisons to the infamous 2007 Lubo stock manipulation scandal in South Korea.
On April 18, RAVE r
GateNews26m ago
Research reveals: Polymarket players take home 30% of profits by winning 3% of the positions—more than 70% of players absorb all losses
A new study analyzes Polymarket’s trading records from 2023–2025 and shows that only 3.14% of experienced winners control more than 30% of the profits. Crowd participation alone is not enough to explain overall accuracy; at the same time, it tracks 1,950 highly suspicious insider trading accounts that, while not driving predictions, amplified price volatility. The case shows that large bets were placed and profits were made before the U.S. announced developments regarding Venezuela. The research questions “wisdom of crowds” and emphasizes the need for increasingly strict regulation.
ChainNewsAbmedia1h ago
France: More than 40 crypto investor kidnappings in 2026, involving leaked tax data
According to Market Forces Africa, reported on April 27, incidents of kidnapping and violent attacks targeting cryptocurrency investors in France have increased sharply. On the X platform, Telegram founder Pavel Durov said that since the beginning of 2026, he has recorded 41 cases of cryptocurrency investor kidnappings, averaging one incident every 2.5 days, and that they are linked to a leak of French tax records.
MarketWhisper1h ago
Hubei cybersecurity police received a Second Class Merit Award, solving the province’s first “hundred-million-yuan” virtual-coin theft case in 70 days
According to a report by Hubei Daily on April 27, Guo Tingyu, a police officer from the Cyber Security Brigade of the Qingshan Branch of the Wuhan Municipal Public Security Bureau, was recently awarded the Individual Second-Class Merit. Guo Tingyu graduated from Huazhong University of Science and Technology with a degree in computer science. In 2023, he passed the civil service exam to join the police force. In early 2024, he took charge of the first virtual currency theft case in all of Hubei Province. After nearly 70 days of investigation and case-solving, the amount of involved funds exceeded 100 million yuan, and all five suspects were fully dealt with in accordance with the law.
MarketWhisper1h ago
Litecoin Executes Deep Chain Reorganization to Undo MWEB Privacy Layer Exploit
Gate News message, April 27 — Litecoin underwent a deep chain reorganization on Saturday (April 26) after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, the Litecoin Foundation announced. The reorg spanned blocks 3,095,930 to 3,095,943 and
GateNews2h ago
China Breaks Cryptocurrency Theft Ring Worth Over $140 Million, Arrests 5 Suspects
Gate News message, April 27 — A cybercrime unit in Wuhan, China's Hubei Province, has dismantled a cryptocurrency theft ring involving counterfeit wallet applications, with investigations revealing over 100 million yuan (approximately $14 million) in illicit proceeds. Five suspects have been
GateNews2h ago
