$91K Oracle Incident Forces Sui DeFi Protocol Full Sail to Shut Down

Points of Focus

• Full Sail is shutting down after a $91K drain from three automated vaults.
• The team says Switchboard oracle prices were manipulated by about 100x.
• Protocol liquidity and team funds will cover affected users.

Sui-based DeFi protocol Full Sail is shutting down after an Aug. 29 oracle incident drained about $91,000 from three automated vaults. The protocol has disabled new deposits and liquidity provider reward claims, while regular pools are set to move into withdrawal-only mode after final security checks. 

Full Sail says remaining protocol-owned liquidity will go to affected users, with the team covering any shortfall.

Full Sail says attacker manipulated Switchboard oracle prices

Full Sail said in a Sept. 1 X thread that the attacker exploited Switchboard production code governing who could sign oracle price updates. According to the protocol, the attacker added a controlled key to a live oracle, pushed reported prices to about 1% of market value, deposited into the affected vaults, then restored prices and withdrew more value than was initially deposited.

1/12

Full Sail is sunsetting on @SuiNetwork.

This was a difficult decision. Our immediate priority is returning what affected users lost and completing an orderly wind down.

— Full Sail ⛵ (@FullSailFi) September 1, 2026

Full Sail said its admin keys weren’t compromised and direct liquidity pool positions were unaffected. Its live app now shows three vaults still paused while deposits and LP reward claims remain disabled.

Switchboard’s account is less specific. In an Aug. 29 X post, the oracle provider described a potential compromise of its Move-based implementations and said contributors halted the network on Aptos, Sui, IOTA and Movement while investigating. That disclosure didn’t confirm Full Sail’s more detailed claim about how oracle signing authorization was changed.

Late last night reports emerged about a potential compromise of the Switchboard network move language based implementations. Contributors coordinated with relevant teams and security organizations to halt the Switchboard network on Aptos, Sui, Iota and Movement. While there have…

— Switchboard ⚡️ (@switchboardxyz) August 29, 2026

$91K loss approaches half of Full Sail’s current TVL

For scale, DefiLlama data now puts Full Sail’s TVL at about $187,500, down 52.3% over 30 days. The $91,000 drained is equal to roughly 48.5% of that current figure. The comparison has a limit because today’s TVL is a post-incident snapshot, not the amount held immediately before the attack.

The fallout extended beyond Sui. Full Sail said IOTA-based lending protocol Virtue reported about $455,000 in losses tied to the same Switchboard incident. Virtue’s own incident disclosure said 47 liquidation events affected 45 users after its IOTA price feed was manipulated, and the protocol froze borrowing, repayment, deposits, withdrawals and liquidations.

Full Sail has chosen to shut down rather than restart the affected vault product. Its website says vault depositors will be compensated, while the Sept. 1 wind-down plan says remaining protocol liquidity will go to users first and the team will absorb any shortfall. DefiLlama records Aug. 29 as Full Sail’s first reported security incident.