Over $6.3M was drained across three incidents between April 20 and April 26, 2026: a multisig role hijack on Purrlend that drained both its HyperEVM and MegaETH deployments, an EIP-712 signature validation flaw exploited on Giddy’s GiddyVaultV3 contract, and a compromised admin private key that emptied three Sui-based vaults on Volo Protocol.
This week’s Recoveris report covers the Purrlend dual-chain drain executed through a malicious bridge-role addition to a 2-of-3 admin multisig, the Giddy GiddyVaultV3 exploit that replayed a partial EIP-712 signature with attacker-controlled swap parameters, and the Volo Protocol vault drain that began with a socially engineered admin key compromise and triggered a partial freeze through coordination with the Sui Foundation.
Purrlend – ~$1,520,000 | April 25, 2026 | Infrastructure Breach
On April 25, an attacker drained approximately $1.52 million from DeFi lender Purrlend across its HyperEVM and MegaETH deployments. The drain was executed through the protocol’s 2-of-3 admin multisig, which roughly eight hours before the incident added the attacker’s address as a “bridge” role. That role inherited elevated permissions from an older Aave-style implementation and allowed unauthorized withdrawal of liquidity-pool assets across both networks.
On HyperEVM the attacker extracted 449,684 USDC, 214,125 USDT0, and 194,745 USDH along with smaller amounts of wrapped native tokens. On MegaETH the haul included 163,169 USDT0, 36.86 WETH, and 75,745 USDm. The protocol paused operations on both deployments shortly after the incident and confirmed the multisig action as the entry point.
This is a textbook administrative-permission failure: a 2-of-3 multisig with no timelock, no timelock alert, and inherited role logic from a forked codebase. The attacker either compromised at least two signers or the role-add transaction itself originated from compromised internal infrastructure. Either path leaves a clear on-chain timeline starting eight hours before the drain, which is the window where coordinated tracing and exchange-side flagging are most viable.
Sources: Crypto Briefing, Live Bitcoin News
Giddy (GiddyVaultV3) – ~$1,300,000 | April 23, 2026 | Smart Contract
On April 23, an attacker drained approximately $1.3 million from Giddy’s GiddyVaultV3 contract by exploiting a flaw in its EIP-712 signature validation logic. The contract validated only part of the data inside its SwapInfo structure, leaving the aggregator address, fromToken, toToken, and amount fields outside the signed payload. The attacker replayed a previously valid signature and swapped in malicious parameters: the aggregator was redirected to an attacker-controlled contract, fromToken was replaced with the strategy’s LP tokens, toToken was substituted with a malicious token, and the amount was set to the maximum value.
Incomplete signature coverage is one of the most common EIP-712 implementation errors and has been exploited repeatedly across DeFi over the past two years. The vulnerability is invisible to standard ERC-20 approval checks because the user did sign a real transaction, but the signature scope did not bind the parameters that actually move funds. Once an attacker holds a single signature with weak coverage, the cost of executing the drain is a few gas fees.
Recovery in signature-replay cases depends on identifying the consolidation wallet quickly and engaging exchanges before assets are bridged or swapped through DEX aggregators. The attack pattern leaves a clean on-chain trail from the victim contract to the attacker’s swap path, which is the foundation of any freeze request directed at downstream liquidity venues.
Sources: SlowMist Hacked, Live Bitcoin News
Volo Protocol – ~$3,500,000 | April 22, 2026 | Private Key Compromise
On April 22, an attacker drained approximately $3.5 million from three Volo Protocol vaults on Sui after compromising a privileged admin private key. The affected vaults held wrapped bitcoin (WBTC), Matridock’s tokenized gold token (XAUm), and USDC. Volo’s audited smart contracts were not the attack vector. Both GoPlus Security and ExVul confirmed the breach traced to a compromised operator key linked to social engineering rather than a contract flaw.
Volo froze all vaults shortly after the incident, coordinated with the Sui Foundation and on-chain investigators, and blocked an attempt to bridge 19.6 WBTC out of the Sui ecosystem. Approximately $500,000 was frozen within the first 30 minutes. The remaining $28 million in protocol TVL was confirmed safe, and Volo announced it will absorb the loss rather than pass it to users.
Compromised admin keys remain one of the most consistent loss categories in DeFi, and the response window for this attack class is unusually short on chains with strong validator coordination. The Sui-side block on the WBTC bridge attempt is a useful reference point: when an issuer or chain coordinator can intervene at the bridge layer in the first minutes, the realized loss can be materially lower than the headline number. Recoveris’s coordination work for institutional clients targets exactly this layer.
Sources: CoinDesk, Bitcoin.com News
If your platform or users have been affected by recent exploits, immediate forensic intervention is critical to tracing and freezing assets before they reach obfuscation services.
