A single signing-key compromise in Switchboard's oracle infrastructure halted price feeds across four Move-based blockchains on August 29, 2026, triggering at least $546,000 in confirmed protocol losses, one protocol shutdown, and a cascade of frozen vaults and forced liquidations across Sui, Apt...
"Deposits and withdrawals will remain paused until oracle integrity is restored and verified to prevent further losses." — Full Sail, Official Statement (29 August 2026)
A single signing-key compromise in Switchboard's oracle infrastructure halted price feeds across four Move-based blockchains on August 29, 2026, triggering at least $546,000 in confirmed protocol losses, one protocol shutdown, and a cascade of frozen vaults and forced liquidations across Sui, Aptos, IOTA, and Movement.
The attacker gained control of all 14 oracle signing keys on Switchboard's IOTA mainnet queue, manipulated the IOTA token price to $10 million, minted approximately 4.94 million VUSD through the Virtue CDP protocol, then pushed the feed near zero to trigger 47 liquidations across 45 users. Full Sail, a Sui-based decentralized exchange with $226,000 in TVL, confirmed $91,000 drained from three vaults and announced it will permanently cease operations. As of September 4, Switchboard has not published a root cause analysis, a restart timeline, or a compensation commitment.
The incident exposes a structural vulnerability in the Move-language oracle stack: Switchboard is the dominant oracle provider across all four affected chains, and its Solana deployment — built on a different codebase — was unaffected. Oracles secure an estimated $4–5 billion in TVL through Switchboard alone. Chainlink, which holds approximately 70% of the broader oracle market by total value secured ($33.1 billion as of May 2026, per DefiLlama), does not operate natively on Move-based chains, leaving these ecosystems with limited oracle redundancy.
August 29, 2026: Switchboard detects a potential compromise in its Move-based oracle implementations. Price feeds are halted across Sui, Aptos, IOTA, and Movement. Switchboard advises all users, including those on unaffected Solana deployments, to consider alternative oracle providers as a precaution.
August 29–30: Full Sail confirms vault losses on Sui. Deposits and withdrawals are paused. Volo, another Sui protocol, initiates a precautionary pause on vault operations but reports no losses. Virtue Money on IOTA reports $455,000 in losses and freezes all protocol functions — borrowing, repayment, deposits, withdrawals, liquidations, and flash loans. VUSD, Virtue's stablecoin, becomes materially undercollateralized.
August 31–September 1: Full Sail's TVL stands at approximately $229,000 with 24-hour DEX volume near $50 — effectively zero activity. Seven-day volume had been $2.99 million; 30-day volume $9.10 million, according to CryptoSlate.
September 2–3: Full Sail announces permanent wind-down. New deposits and LP reward claims are disabled. Regular pools will shift to withdrawal-only mode after final security checks. The team commits to covering any shortfall to ensure depositors are reimbursed before other claims.
As of September 4: Switchboard has not published a technical postmortem, confirmed the full scope of affected integrations, or provided a restart timeline for Move-based deployments.
The exploit was a key-level compromise, not a market-manipulation attack. The distinction matters.
In a traditional oracle manipulation (such as the 2022 Mango Markets incident), an attacker uses capital to move a token's spot price on exchanges, causing the oracle to report the manipulated price faithfully. The oracle works as designed; the problem is thin liquidity.
In the Switchboard breach, the attacker compromised the cryptographic signing keys that oracle operators use to attest to price data. With control of all 14 signing keys on Switchboard's IOTA mainnet queue, the attacker bypassed market conditions entirely and wrote arbitrary price data directly into the oracle feed.
The attack sequence on IOTA:
This is a supply-chain attack on infrastructure, not a capital-intensive market exploit. The cost to the attacker was minimal. The damage was disproportionate.
| Metric | Value | |--------|-------| | Confirmed loss | ~$455,000 | | Users liquidated | 45 | | Total liquidation events | 47 | | VUSD minted fraudulently | ~4.94 million | | Protocol status | All functions frozen | | VUSD collateral status | Materially undercollateralized |
Virtue froze all protocol operations: borrowing, repayment, deposits, withdrawals, liquidations, and flash loans. Exchange addresses associated with the attacker were flagged. The protocol had not published a compensation plan as of September 4.
| Metric | Value | |--------|-------| | Confirmed loss | ~$91,000 | | Vaults affected | 3 | | TVL at time of halt | ~$226,000–$229,000 | | Protocol status | Permanently winding down | | Compensation plan | Team covering shortfall; depositors prioritized |
Full Sail's price feeds were manipulated to approximately 100x below market value, enabling the attacker to drain three automated vaults. The protocol requested financial support from Mysten Labs, the core developer of the Sui blockchain. Mysten Labs declined.
Full Sail stated that all remaining protocol-owned liquidity will be directed to user compensation, with the team pledging to cover any gap. The protocol will cease operations entirely once reimbursements are complete.
Volo paused vault deposits and withdrawals as a precautionary measure. No losses were reported. User funds were reported as safe.
The vulnerability's confinement to Move-based deployments — while Switchboard's Solana implementation remained operational — raises questions about the security architecture of Move-language oracle implementations specifically.
Move was originally developed at Meta (then Facebook) for the Diem stablecoin project. After Diem's dissolution, the language became the foundation for Aptos and Sui, and subsequently for derivative ecosystems including Movement and IOTA's newer infrastructure.
Four blockchains now share a common oracle dependency through Switchboard's Move-based stack:
| Chain | Status During Halt | Confirmed Protocol Losses | |-------|-------------------|--------------------------| | Sui | Chain operational; protocols paused | $91,000 (Full Sail) | | IOTA | Chain operational; Virtue frozen | $455,000 (Virtue Money) | | Aptos | Oracle feeds halted | None publicly confirmed | | Movement | Oracle feeds halted | None publicly confirmed |
Switchboard's decision to halt all four Move-based deployments simultaneously, rather than isolating the confirmed IOTA breach, suggests the vulnerability may be architectural — potentially affecting the shared Move-language codebase rather than a single chain's configuration.
The affected chains remained operational at the network level; no chain halt occurred. But DeFi protocols dependent on Switchboard for price data were effectively paralyzed, unable to process trades, manage collateral, or execute liquidations with reliable pricing.
The oracle market is heavily concentrated. According to DefiLlama data from May 2026, Chainlink secures approximately $33.1 billion in total value secured (TVS) across 505 protocols, representing roughly 70% of the oracle market by value. Chronicle holds $7.5 billion, RedStone $3.6 billion, and Pyth $3.1 billion.
Switchboard occupies a different niche. It launched as a Solana-native oracle and expanded to Move-based chains where Chainlink does not operate natively. Switchboard secures an estimated $4–5 billion in TVL.
This creates an asymmetric dependency: on EVM-compatible chains, protocols can choose from multiple oracle providers and implement fallback systems. On Move-based chains, Switchboard has been the primary — in some cases, the only — oracle infrastructure available. When it went down, there was no readily available alternative.
The concentration risk is compounded by the relatively small size of Move-based DeFi ecosystems. SUI's market capitalization was approximately $3.04 billion at the time of the incident, with the token trading near $0.75. The total DeFi TVL across all four affected chains is a fraction of Ethereum's. But the dependency ratio — the share of DeFi activity reliant on a single oracle provider — is higher than on any major EVM chain.
Oracle-related exploits are among the most persistent and costly attack vectors in DeFi:
| Incident | Date | Loss | Type | |----------|------|------|------| | Mango Markets | October 2022 | $116M | Market manipulation | | 2022 oracle attacks (aggregate) | 2022 | $403.2M | Various manipulation | | Rhea Finance | April 2026 | $7.6M | Coordinated oracle manipulation | | Moonwell | February 2026 | Mispriced cbETH | Configuration error | | Switchboard (Virtue + Full Sail) | August 2026 | $546K+ | Key compromise |
The Switchboard incident is notable not for the dollar amount — $546,000 is small relative to the Mango Markets exploit — but for the attack vector. Key compromise represents a more fundamental failure than price manipulation. In a key compromise, the oracle's security model itself is broken. No amount of liquidity depth or TWAP smoothing would have prevented it.
The Mango Markets exploit required $10 million in initial capital and produced $116 million in losses. The Switchboard exploit required access to signing keys — a supply-chain breach — and the cost of the attack was effectively the cost of compromising those keys. The asymmetry between attack cost and damage is more extreme.
Several gaps in the ecosystem response have become apparent:
No postmortem. Six days after the initial halt, Switchboard has not published a root cause analysis. Affected protocols, users, and chains lack the technical detail needed to assess ongoing risk or make informed decisions about future oracle dependencies.
No compensation framework. Switchboard has not committed to compensating affected users or protocols. Full Sail is covering losses from its own reserves and team funds. Virtue has not announced a compensation plan.
No chain-level backstop. Mysten Labs declined Full Sail's request for financial support. This establishes a precedent: L1 developers do not view themselves as insurers of last resort for DeFi protocols affected by infrastructure failures on their chains. The precedent contrasts with some historical responses — Sui's Cetus Protocol exploit in May 2025, which caused $223 million in losses, involved a different ecosystem response dynamic.
Limited oracle diversity. The incident has not triggered a visible migration toward alternative oracle providers on Move-based chains, in part because alternatives with equivalent coverage do not readily exist for these ecosystems. Pyth operates on some Move chains but does not replicate Switchboard's full integration footprint.
The Switchboard oracle breach is a small incident by dollar value and a significant one by implication. The $546,000 in confirmed losses is rounding error relative to the $33.1 billion secured by Chainlink or even the $4–5 billion in Switchboard's own TVL. But the attack exposed a structural vulnerability: four independent blockchains sharing a common oracle dependency through a single provider's Move-language codebase.
The attack vector — key compromise rather than market manipulation — is harder to detect, cheaper to execute, and not addressable through the usual DeFi defense mechanisms (TWAP oracles, liquidity depth requirements, circuit breakers). It is an infrastructure supply-chain attack, and the oracle market's concentration makes it a systemic risk.
The absence of a postmortem six days later compounds the problem. Protocols building on Move-based chains cannot make informed decisions about oracle risk without understanding what failed, whether it has been fixed, and what architectural changes are needed to prevent recurrence. The oracle market's structure — where Chainlink dominates EVM chains and smaller providers serve non-EVM ecosystems with less redundancy — means that the chains least equipped to absorb oracle failures are the most exposed to them.
For oracle infrastructure, the question is not whether the next key compromise will happen, but whether the ecosystem will have built the redundancy and key-management standards needed to contain it when it does.