Cross-chain oracle compromise triggers liquidations and frozen vaults across multiple DeFi networks

Switchboard, an oracle provider that supplies price data to DeFi applications, said contributors halted its deployments on Aptos, Sui, IOTA and Movement after reports of a potential Switchboard Move oracle compromise in its Move-language implementations.

At least three applications reported losses, freezes or precautionary access restrictions as Switchboard advised users to migrate temporarily to alternatives. The provider said it had not received similar reports about its Solana implementation, but it has not published a root cause or a timetable for restoring the four Move deployments.

Switchboard Move oracle compromise hits DeFi apps

Sui-based exchange Full Sail confirmed that its vaults lost funds and said deposits and withdrawals would remain paused until oracle integrity was restored and verified. Its disclosure did not identify the affected vaults or assets, provide transaction records, or quantify the loss.

Full Sail's vault documentation says users delegate liquidity management to an automated system that rebalances concentrated positions using real-time market data. Separate oracle-protection documentation describes checks that compare Switchboard prices with on-chain pool prices, test updates against 50 to 70 recent observations, and can block prices or pause emissions. Full Sail has not explained whether those controls fired, applied to the affected vaults, or were related to the reported losses.

On Aug. 31, DefiLlama placed Full Sail at roughly $229,000 in total value locked. Its rolling DEX volume was about $50 over 24 hours, $2.99 million over seven days and $9.10 million over 30 days. Those windows include pre-incident activity and do not establish how much value changed because of the event.

Virtue details IOTA price manipulation

The most detailed account came from IOTA credit protocol Virtue. It said an attacker gained control of the signing keys used by all 14 oracles on Switchboard's IOTA mainnet queue and pushed IOTA's reported price to $10 million. The attacker then deposited 1 IOTA and minted about 4.94 million VUSD, according to Virtue.

Virtue said the feed was later pushed near zero, triggering 47 liquidations that affected 45 users. It froze borrowing, repayment, deposits, withdrawals, liquidations and flash loans, and warned that VUSD was materially undercollateralized while remediation was pending. Those figures relate to Virtue, not Full Sail's undisclosed loss.

Volo pauses access as networks stay online

On Sui, Volo said it paused vault deposits and withdrawals as a precaution because of a Switchboard dependency. Volo said its vaults were unaffected and user funds were safe.

Sui's status page showed all systems operational on Aug. 31, while IOTA's page showed mainnet services operating with listed incidents resolved. Equivalent status evidence was not established for Aptos or Movement.

The verified impact is uneven but material: a confirmed yet unquantified Full Sail loss, a detailed manipulation and protocol freeze at Virtue, and a preventive access pause at Volo. Switchboard has not published a complete list of affected integrations, leaving the full application footprint of the suspected Switchboard Move oracle compromise unresolved.