Full Sail, a decentralized finance protocol on the Sui blockchain, is winding down after a security incident tied to oracle provider Switchboard ended in confirmed losses — a small exploit with an outsized casualty list.
The protocol announced on X that it had disabled new deposits and liquidity-provider reward claims immediately, with regular pools moving to withdrawal-only mode after final security checks. Compensating depositors is the stated top priority: Full Sail says it will use remaining protocol-owned liquidity to repay users, with the team covering any shortfall so community depositors are made whole first. Withdrawal and claim instructions are expected within days.
The Timeline
The incident began to surface on Saturday, August 29, when Switchboard said it was investigating a potential compromise of its Move-based oracle implementations and halted its network on Aptos, Sui, IOTA and Movement. Full Sail disclosed the same day that it had confirmed a loss of funds and paused deposits and withdrawals pending investigation.
The protocol later quantified the damage: an attacker removed roughly $91,000 from three of its automated vaults. Virtue, a stablecoin lending protocol built on IOTA, separately reported approximately $455,000 in losses and said the backing of its VUSD stablecoin had been impaired. CryptoSlate reported liquidations and frozen vaults rippling across multiple DeFi networks as the oracle outage propagated.
Switchboard has not yet published a full technical post-mortem of how its Move implementations were compromised, and no attribution has been offered. The incident remains officially a suspected infrastructure compromise.
What It Shows About Oracle Risk
The blast radius is the story. A single oracle provider's implementation bug simultaneously knocked four chains offline for price data and took down consuming protocols that had no vulnerability of their own — Full Sail's vaults were drained not through their own code, but through the infrastructure they trusted to price assets.
For DeFi protocols, the incident is a case study in dependency risk: oracle diversification and circuit breakers that pause vault actions when price feeds go stale or stop are the difference between an outage and a drain. For users, it is a reminder that "audited protocol" covers only the protocol — not the third-party infrastructure it leans on.
Full Sail's wind-down, with team-funded compensation, is the unusual ending: most small-exploit protocols simply fade. The repayment promise, however, remains just that until withdrawals open and depositors report being made whole.
TrustGrade tracks the security posture of DeFi protocols, oracles and chain infrastructure. Verified, registry-backed security scoring arrives with TrustGrade Code Scoring in December 2026.