No exploit of Lulo's contracts found in the sources reviewed, including DefiLlama's protocol page
—outcome unclear- Outcome
- No hack on record as of 23 Oct 2026; absence from sources checked does not prove none occurred
Lulo is a non-custodial stablecoin yield service, operated by Lulo Labs Inc., that takes a deposit of USDC or another supported stablecoin and spreads it across several lending and yield protocols on Solana and Ethereum 136. Instead of picking one pool, it weights each protocol by its value locked and the rate it pays 1. Lulo's distinguishing feature is a two-tier design: Protected deposits are covered against failures in the underlying protocols, and Boost deposits earn more by absorbing those losses first 45. Coverage does not extend to Lulo's own contracts or to stablecoin depegs 5.
Lulo works like an index for stablecoin lending. You connect a wallet, choose a product and deposit; Lulo's contracts move the funds into the protocols on its list 2. Protocols with more value locked and better rates get a bigger share, and weights shift as those numbers change 13. The contracts can only deposit into and withdraw from that whitelisted set, and Lulo says it can pause allocations if something looks wrong 9.
As of 23 October 2026, the list includes Morpho, Pendle and Maple on Ethereum and Kamino, Jupiter and Neutrl on Solana 3. Users on Solana do not need to bridge to reach the Ethereum venues themselves 7. The trade-off: your deposit inherits the risks of each of these protocols, including credit strategies such as Maple's lending to vetted borrowers and Neutrl's delta-neutral yield 3.
Wallets and apps can embed Lulo through a developer API; Lulo says it has more than 50 such integrations, naming Solflare, Fuse and Decaf 11.
The two products are two sides of one arrangement 45:
The cover is only as large as the Boost pool. Lulo says a total loss in a single integrated protocol is compensated in full "as long as the coverage pool is sufficient," and publishes the coverage ratio on-chain and on its protection dashboard 5. It is not insurance from a regulated insurer.
Lulo charges a 10% performance fee on yield and says there are no deposit fees 4. On a $1,000 deposit that earns $40 in a year, the fee would be $4, leaving $36 before network costs (illustrative; actual yields vary). Rates shown on the site change constantly, and Protected yield is lower than Boost because part of it pays for coverage 411. You also pay Solana or Ethereum network fees when you transact.
Protected deposits can be withdrawn at any time with no lockup 2. Boost deposits are locked for a period because that capital must stay available to pay Protected users; Lulo's docs do not state the length, so check it in the app before depositing 24. Withdrawals also depend on liquidity in the underlying protocols, which can tighten when lending markets are heavily used.
Lulo lists five audits of its contracts, by Certora, Halborn, OtterSec, Offside Labs and Sec3, with reports linked but undated 8. An audit lowers but does not remove the chance of a bug. Lulo itself calls a flaw in its own contracts "the most direct risk" to deposits 9.
Coverage does not apply to 5:
The Terms state that Lulo never holds custody of your assets, that you are responsible for your keys, that assets "may lose some or all of their value," and cap Lulo's liability at $1,000 6. They exclude users in sanctioned jurisdictions and do not publish a wider list of restricted countries 6.
Solana Compass dates Lulo's launch to late 2023 and records its Circle Alliance membership in July 2024, a Certora audit between November 2024 and January 2025, and an iOS app in 2025 7. DefiLlama reported about $31 million locked on 20 October 2026 10. Lulo's homepage states "$100M+" in protected capital 11; the two figures may count different things, and the company figure is undated.
Hacks in DefiLlama’s public database are also scored as the security record on the Lulo rating page.
See CoinPulse's rating and evidence for Lulo. Related: yield aggregators, what yield farming is, what DeFi is, self-custody.
EarningWhat is yield farming and how does it work?Yield farming lets you earn rewards by lending or supplying crypto to DeFi protocols. Here is how it works, plus the risks to weigh first.8 min read·
SecurityWhat Is a Rug Pull, and How to Spot OneA rug pull is when a project's team abandons it and drains investor funds. Learn the main types, the warning signs, and how to check a token before you buy.7 min read·
RegulationBitcoin ETF Outflows Weigh on Market as Interactive Brokers Launches Ethereum StakingSpot Bitcoin ETFs recorded $65.4 million in net outflows as hawkish Federal Reserve comments pressured prices. Meanwhile, Interactive Brokers rolled out Ethereum staking for eligible US clients.4 min read·
MarketsCFTC Opens Retail Crypto Leverage Rulemaking as Bitcoin Holds Near $84KThe CFTC has begun a rulemaking on leveraged retail crypto trading, while Bitcoin hovers near $84,000 and traders wait for U.S. inflation data and the Fed’s October meeting.4 min read·
MarketsUS Moves $1B in Seized Bitcoin as Senate Scrutiny of Tether GrowsU.S.-linked wallets shifted 12,267 BTC from a Bitfinex hack seizure address without any exchange deposit, while Senator Richard Blumenthal pressed Cantor Fitzgerald over its Tether partnership.3 min read·