A suspected compromise of Switchboard's Move-based oracles led to halted deployments on Aptos, Sui, IOTA, and Movement, triggering liquidations, vault freezes, and user fund restrictions across several DeFi protocols
Several decentralized finance (DeFi) protocols across multiple blockchain networks have been disrupted after Switchboard, a provider of on-chain price oracles, halted its Move-language deployments due to a suspected security incident. The action affected Switchboard's oracle services on Aptos, Sui, IOTA, and Movement, leaving at least three DeFi applications reporting losses, frozen vaults, or restricted user access as a precaution. Switchboard advised affected protocols to migrate to alternative oracle solutions while it investigates the root cause. The company stated that its Solana-based oracle implementation was not impacted, but has not provided a timeline for restoring Move-based services or a full list of affected integrations.
DeFi Protocols Respond
On Sui, decentralized exchange Full Sail confirmed that some of its vaults lost funds and announced a pause on deposits and withdrawals until Switchboard's oracle integrity could be reestablished and verified. Full Sail did not specify which vaults or assets were affected, nor did it disclose the amount lost or provide transaction details. According to its documentation, Full Sail's vaults use automated liquidity management that relies on real-time market data, with built-in oracle protection mechanisms designed to compare Switchboard prices against on-chain pool prices and block suspicious updates. The protocol has not clarified whether these controls were triggered or if they mitigated the incident's impact.
Attack on Virtue Protocol
The most detailed incident report came from Virtue, a credit protocol operating on IOTA. Virtue stated that an attacker gained control of the signing keys for all 14 oracles in Switchboard's IOTA mainnet queue, allowing them to manipulate the reported IOTA price to $10 million. The attacker then deposited 1 IOTA and minted approximately 4.94 million VUSD, Virtue's stablecoin. Subsequently, the oracle feed was pushed near zero, triggering 47 liquidations that affected 45 users. Virtue responded by freezing all borrowing, repayment, deposits, withdrawals, liquidations, and flash loans, and warned that VUSD was now materially undercollateralized. The protocol has not yet announced a remediation plan or timeline for restoring normal operations.
Precautionary Freezes and Uncertainty
Other protocols took preventive measures. On Sui, Volo paused vault deposits and withdrawals due to its reliance on Switchboard, but reported that user funds remained unaffected. Status pages for Sui and IOTA indicated that core network services were operational as of August 31, with IOTA listing the incident as resolved. There was no equivalent status confirmation for Aptos or Movement at the time of reporting. The full scope of the incident remains unclear, as Switchboard has not published a comprehensive list of affected applications or provided a detailed post-mortem. The uneven impact-ranging from confirmed losses and protocol freezes to precautionary pauses-highlights the risks DeFi protocols face when relying on third-party oracle providers for critical price data.
According to DeFiLlama, Full Sail had approximately $229,000 in total value locked as of August 31, with a 24-hour rolling DEX volume of about $50, $2.99 million over seven days, and $9.10 million over 30 days. These figures include activity before the incident and do not isolate the value affected by the oracle compromise. Virtue reported 47 liquidations impacting 45 users, but did not quantify the total loss in dollar terms. No loss figures were disclosed for Volo, which stated its vaults were not directly affected.
Oracles are a foundational component of DeFi infrastructure, providing external price data that smart contracts use to trigger liquidations, rebalance vaults, and manage collateral. When an oracle is compromised, attackers can manipulate reported prices to exploit protocol logic, often resulting in user losses, forced liquidations, or protocol shutdowns. The incident involving Switchboard's Move-based deployments underscores the importance of robust oracle security, multi-source price verification, and rapid incident response for protocols that depend on external data feeds. As DeFi continues to expand across new blockchain networks, the reliability and security of oracle providers remain a critical point of risk and scrutiny for developers and users alike.
