Scallop Protocol Loses 150,000 SUI in Rewards Exploit

Scallop Protocol, a leading lending platform on the Sui Network, lost approximately 150,000 SUI tokens worth around $270,000 in an exploit targeting a deprecated rewards contract on April 26, 2026.

The attacker exploited a vulnerability in a V2 sSUI spool rewards contract deployed in November 2023, more than 17 months earlier. The flaw involved an uninitialized "last_index" variable, which tracks accumulated rewards for stakers. By staking about 136,000 sSUI tokens, the attacker claimed rewards as if participating since the pool's inception in August 2023. The spool index had reached roughly 1.19 billion over 20 months, allowing the extraction of 162 trillion reward points redeemed one-to-one for the entire 150,000 SUI balance in a single transaction. Blockchain records confirm the drain via transaction hash 6WNDjCX3W852hipq6yrHhpUaSFHSPWfTxuLKaQkgNfVL. The stolen funds were then routed through a Sui-based mixing service, complicating recovery.

Scallop disclosed the incident at 12:50 UTC via a post on X, stating, "We have identified an exploit affecting a side contract related to Scallop’s sSUI spool rewards pool, resulting in a loss of approximately 150K SUI. The affected...