Sui-native DeFi monitoring: what changed for Scallop's security model?

TL;DR: A DeFi lending protocol on Sui cannot rely on EVM-first monitoring, Telegram-only alerts, or manual onchain response when 23 assets and $130M in TVL create a fast-moving attack surface, according to Blockaid's analysis of Scallop. The case for protocol-native, threshold-driven detection is no longer theoretical; coverage gaps become loss events before teams can react.

Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “How Scallop Secures its Lending Protocol with Blockaid's Onchain Monitoring”.

By the numbers:

• Scallop manages pools across 23 assets with approximately $130M in TVL.
• Scallop would have $130M+ uninsured against any attack without automated security monitoring.
• Since Q1-2026 implementation, Scallop has achieved MTTD under 1 minute from any anomalous onchain event.

Key questions

Q: What breaks when security monitoring is built on the wrong chain model?

A: Monitoring breaks when the control logic assumes a different execution model than the one the protocol actually uses.

Q: Why do protocol teams need separate controls for financial and administrative risk?

A: Because the two risk classes behave differently and require different response paths.

Q: What signs show that manual incident response is too slow for onchain threats?

A: The clearest sign is that loss can occur before a human can triage, approve, and execute containment.

Practitioner guidance

• Define chain-native detection logic Map monitoring to the protocol's native execution model, including object ownership, dynamic fields, and transaction semantics, instead of relying on EVM-style abstractions.
• Split economic and administrative alerts Create distinct monitors for oracle manipulation, liquidity and outflow anomalies, privileged function calls, and registry changes so response paths stay specific.
• Pre-authorise automated containment Use a programmable response that can pause the protocol or otherwise contain a confirmed threat without waiting for a manual approval chain.

Bottom line: Scallop's monitoring problem was not just alert volume, but a mismatch between Sui's runtime semantics and the assumptions built into EVM-first tools.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →