Skip to main content
AVOID.NET

Scallop Lend

avoid.net/scallop-lend→32/100·72% conf.
[AI-DRAFTED · AWAITING FACT-CHECK][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2YN8j3…t5mQ
last updated 2026-08-29

Summary

Scallop Lend is a DeFi lending and borrowing protocol deployed on the Sui blockchain, and the first DeFi project to receive an official grant from the Sui Foundation. On April 26, 2026, the protocol suffered a flash-loan exploit that drained approximately 150,000 SUI (roughly $142,000) from a deprecated rewards contract that had remained callable on-chain for approximately 17 months despite no longer being in active use. The protocol covered 100% of user losses from treasury reserves and resumed operations within two hours, though the incident raised questions about legacy contract hygiene and the completeness of prior audits by OtterSec, MoveBit, and Zellic.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Scallop Lend?

Timeline(9 events)

November 2023

Scallop deploys V2 sSUI Spool rewards contract, containing uninitialized 'last_index' variable that will later be exploited.

The Merkle

March 2024

Scallop raises $3 million in strategic round co-led by CMS Holdings and 6th Man Ventures, with participation from KuCoin Labs, Mysten Labs, and Blockchain Founders Fund.

Decrypt

12 March 2024

SCA token generation event (TGE); protocol presents SCA tokenomics with 250 million total supply.

Decrypt

February 2025

Scallop passes a full security audit conducted by the Sui Foundation, which does not identify the deprecated V2 spool contract as a live risk.

Blockonomi

12 September 2025

ZachXBT exposes over 200 crypto influencers for undisclosed paid promotions across the industry; specific project names involved were not fully confirmed in available records.

Disruption Banking

29 March 2026

Scallop reports TVL of approximately $130 million, establishing itself as the leading lending and borrowing protocol on Sui.

The Block

26 April 2026

Attacker exploits deprecated V2 sSUI Spool rewards contract, draining 150,000 SUI (~$142,000) by exploiting an uninitialized reward index variable. Stolen assets passed through a Sui privacy mixer.

Multiple — Crypto Times, MoneyCheck, Yahoo Finance

26 April 2026

Scallop team discloses breach at 12:50 UTC, freezes affected contract, and pledges 100% coverage of losses from treasury. Core protocol operations restored within two hours.

Grafa / KuCoin

27 April 2026

Attacker contacts Scallop team, offering to return 80% of stolen funds in exchange for a white-hat bounty. Outcome of negotiations not publicly confirmed.

Crypto Times
Provenance & Audit Trail
Anchored on SolanaVerify on-chain16 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 18 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-5

generated: 5/4/2026, 1:51:10 AM

last updated: 8/29/2026, 1:33:05 AM

4 views

avoid.net — verified advice for a post-truth world