Interest Labs (@IPXLabs) - official Sui validator - withdrew user funds from its Interest Protocol pools on Movement

General
1

Interest Labs (@IPXLabs) — official Sui validator — withdrew user funds from its Interest Protocol pools on Movement

Fact sheet — 2026-07-26

The validator

  • Interest Labs is an official Sui Network validator.
  • Voting power: ~0.5% of the network; stake ~35.7M SUI.
  • On-chain validator address: 0x2ad4ad9e0204d6c2badb7ccb0cbbf840908e16af71cd9a38b5e89f9db7c8b551.
  • Project URL listed in its own on-chain validator record: interestlabs.io.
  • Announced as an official Sui validator by the team on 30 June 2025 (@IPXLabs).

The same team’s product on Movement

  • The same team operated a DEX and farm, Interest Protocol, on the Movement Network (package 0x373aab3f…f70f241), where users deposited liquidity (MOVE / WETH.e and other pairs).

What was done to user funds

  • On 9 March 2026, 21:41–21:43 UTC, a single privileged address withdrew the entire token reserves of at least three Interest Protocol pools and routed the proceeds out through swaps.
  • The withdrawal used an admin-only function, xy, which carries no amount parameter — it removes a pool’s whole balance to a chosen recipient.
  • The address used, 0x878d2e00…19b0, is the same address that controls the protocol’s admin functions (claim_volatile_admin, claim_stable_admin, set_rewards_per_second, add_reward_fa).
  • Amount removed in three minutes: approximately 28,500 MOVE, plus WETH.e and USDC.e, across the three pools.
  • That address now holds 0 MOVE — the funds were swapped and moved on.
  • The pools’ reserves are now zero. LP token holders cannot redeem: the accounting still shows a balance, but the underlying reserves are gone, so withdrawals revert.
  • The product’s website was taken offline shortly afterward.

No hack was reported

  • No hack, exploit, or security breach was ever announced — not by the team, not by any third party. The reserves were not lost to an attacker; they were withdrawn by the protocol’s own admin address.

Context

  • Movement Labs later entered Chapter 11 bankruptcy (July 2026, MOVE down ~99%). The pool withdrawals predate this by months and were not a chain failure — they were direct admin withdrawals of user liquidity.

The point

  • Regardless of which network this occurred on, an operator has no right to withdraw funds that belong to its users. User deposits are not the team’s to take. This conduct is by the same entity that today holds a trusted validator role on Sui.

Evidence (independently verifiable)

2

This was done at the request of the Movement team and the funds went back to the users.

There is discussion and an audit log within Interest Protocol channels.

This is unrelated to Sui, building on Sui, and is seemingly a non-issue after looking into it for a few minutes. Closing this thread.