Scallop freezes sSUI spool rewards contract after ~150K SUI exploit; core lending unaffected

Scallop disclosed an exploit hitting a side contract tied to its sSUI spool rewards pool, with roughly 150K SUI drained before the team froze the affected contract. Core lending contracts on the Sui-based money market are untouched, so deposits and active loans remain intact. The attack vector was scoped to the rewards-distribution logic rather than the main protocol, meaning the damage is contained but user rewards took the hit.

TLDR by @Benthic

More coverage

• Scallop Exploit Drains 150K SUI From Deprecated Rewards Contract (ourcryptotalk.com)
• Scallop Exploit Drains 150K SUI Through Deprecated Contract As ... (mexc.com)
• Scallop Loses 150,000 SUI in sSUI Reward Pool Exploit - Phemex (phemex.com)
• Another DeFi attack drains 150k SUI from obsolete Scallop contract (binance.com)
• Scallop Loses $142K in Flash Loan Attack on Deprecated Contract (cryptotimes.io)

Explore the topic

• Exploit
• SUI