Switchboard Oracle Compromised: Why Price Feeds on Sui, Aptos, IOTA and Movement Have Stopped

The oracle provider Switchboard shut down its price feeds on four blockchains on August 29, 2026: Sui, Aptos, IOTA and Movement. If you hold funds on one of these chains in a lending market, a vault or a collateralised position, this is no footnote from the engineering department. It is the reason your position may not be closable right now. The trigger, on the provider's account, was the suspicion of a compromised oracle key. The chains themselves kept running.

The news matters more than the sum of the damage: what was hit was not a single protocol but the price supply on which many protocols depend at once. If you tried to do something on Sui or Aptos in recent days and ran into a frozen interface, the explanation is here.

What happened on August 29: oracle key compromised, four chains without price feeds

Switchboard operates price feeds through which decentralised applications learn what an asset is currently worth. After detecting a possible compromise, the provider halted these feeds on all four chains where it works in the Move programming language. Its Solana installation was untouched and kept running, according to the report by Cryptobriefing.

According to the same report, an attacker used a compromised oracle key to manipulate the price feed for IOTA. The token's price was temporarily set to ten million US dollars in it. On that basis the attacker minted around 4.94 million VUSD through the CDP protocol Virtue. The stablecoin was thus backed by collateral that never existed in that amount.

The damage did not stop at that one protocol. On this account, 45 users were directly liquidated, and exchange addresses were frozen to slow the outflow. The decentralised trading venue Full Sail on Sui confirmed losses in its automated vaults and suspended deposits and withdrawals.

Oracle, price feed, CDP: the three terms without which the incident makes no sense

An oracle is a service that brings data from outside the blockchain onto the blockchain, because a smart contract has no knowledge of a market price by itself. A price feed is the individual data stream of such an oracle for exactly one asset, so for instance the continuously updated price of IOTA in US dollars. A CDP protocol (collateralised debt position) is an application in which you deposit crypto assets as collateral and are lent a stablecoin against them, in an amount determined by the value of your collateral.

That explains the chain of attack. Whoever controls the price feed controls the basis on which the CDP protocol calculates. If the price recorded there is many times too high, the protocol takes a small deposit for a fortune and issues a correspondingly large amount of stablecoin. There is no flaw in the contract; the contract calculates correctly with wrong numbers.

Why a single key carries so much weight

Oracle networks work with signatures. A data point counts as valid when it is signed by an authorised key. Once such a key falls into the wrong hands, the protocol can no longer tell the forged report from the genuine one. That is precisely why the provider halted the feeds as a precaution, by its own account, rather than correcting individual values: as long as it is unclear which keys are affected, every further price figure is unreliable.

IOTA price at ten million dollars: how a wrong figure becomes real debt

The minted stablecoin is a liability of the protocol towards everyone holding it. The attacker can swap it, send it across a bridge or shift it into other assets, while the deposited collateral remains worth what it actually fetches on the market. What remains is a hole in the backing.

Two things about this matter for you as a user. First, the value of an algorithmically backed stablecoin depends on the backing being sound; a gap in the backing feeds through to the price even if you were never anywhere near the attack. Second, liquidations happen automatically. If you hold a position on a perpetuals venue or in a lending market, the reported price decides whether your collateral still suffices. How differently platforms handle this mechanism is set out in our comparison of perpetuals trading venues, where liquidation rules and price sources sit side by side.

The difference from a stolen wallet key

In a theft from a wallet, one person loses their own funds. Here nobody lost their private key; users lost money because a shared service supplied wrong figures. That is why self-custody does not cover this risk: your keys can sit safely on a device and your position can still be liquidated the moment you have committed it to a protocol.

Full Sail suspends deposits and withdrawals: what users of the Sui vaults now see

Full Sail is a decentralised trading venue on Sui that manages deposits in automated vaults. A vault is a pooled pot into which several users deposit and which trades or provides liquidity according to fixed rules. After the incident the project confirmed losses in these vaults and stopped deposits and withdrawals.

A pause of this kind is at heart a protective measure, because as long as the price basis is missing, a withdrawal could be settled at the wrong rate and leave the remaining depositors worse off. For you it still means one thing: your money is not accessible for now, and the moment of reopening is not in your hands.

45 users liquidated: why a wrong price closes other people's positions

A liquidation is the forced closure of a collateralised position as soon as the value of the collateral falls below a set threshold. This check runs without human involvement and relies on the price the oracle reports. If that price jumps, the protocol dutifully checks and closes whatever is undercollateralised by its calculation.

That also catches users who had nothing to do with the protocol under attack. Those users merely held a position in a market that read the same price feed. Exactly this pattern was already visible in the oracle exploit at Moonwell in late August, where the price source rather than the contract code was likewise the point of entry.

What you can still check after the fact

A closed position cannot be undone. What can be checked is whether the liquidation took place at a price that never existed on the market. That question decides whether any compensation can be argued for at all. So secure the transaction number of the liquidation, the timestamp and the price that applied at that moment across several independent trading venues. Nobody will reconstruct evidence like that for you later.

Move as the common denominator: why Solana kept running and four chains did not

Sui, Aptos, Movement and IOTA's newer infrastructure all rely on the Move programming language. The provider's Solana installation is built differently and stayed in operation. That all the Move installations of all things were stopped at the same time suggests, in the assessment of several trade publications, that the weakness may lie in the shared construction rather than in any single chain. That is an assessment and not a confirmed cause; no investigation report from the provider was publicly available as of this article's cut-off date.

An uncomfortable insight follows for practice. If you have deliberately spread your holdings across several chains in order to cushion outages, everything can still be hit at once when the same supplier software sits underneath. Diversification across chains is not diversification across service providers.

The chain ran, the oracle did not: a difference that decides what you can do

Sui, Aptos, IOTA and Movement carried on producing blocks. What was halted was solely the oracle services. This difference matters in practice, because it determines what remains possible for you: simple transfers of tokens from one address to another work, because no price is needed for them. Everything that depends on a rate stands still, so borrowing, repayment, trading against a reference price and the valuation of collateral.

So if you want to move holdings off an affected chain to safety and they are not tied up in a protocol, that route is open to you. For storage afterwards the plain principle applies that funds on your own device are independent of the availability of somebody else's price service.

How to tell whether your protocol is affected

The application itself usually names its price source in the documentation, often under headings such as oracle or price feed. If you find the name of the affected provider there, your protocol depends on that supply. It also helps to look at the project's channels on X and Discord, because operational notices usually travel faster there than on the home page.

Status check on September 1: which of the provider's pages were reachable

This analysis was carried out by cryptoticker.io itself on September 1, 2026. Method: eight public addresses of the provider and the affected protocols were called individually at 13:02 UTC and the returned HTTP code was recorded. Eight addresses were checked.

The result is mixed. The provider's main page, its application and its documentation each answered with code 200 and were therefore reachable. The addresses for status reports and for the provider's blog did not answer at all at the time of the check. The pages of Full Sail and Virtue answered with code 200; on Full Sail's public home page there was no reference to the incident visible at that point, which is not unusual, because many projects distribute operational notices exclusively via X and Discord.

What I could not check is which individual price feeds are delivering data again, how large the total damage turns out to be, and how many users beyond the 45 mentioned are affected. Those figures require an investigation report from the provider, which was not available at the time of collection. Anyone hoping to rely on a status page did not find one that day.

Checking your portfolio: which positions an oracle outage affects

Go through your holdings asking whether a price matters for them. Tokens simply sitting at an address are untouched by an oracle outage; their value fluctuates, but nothing happens automatically. As soon as a holding is deposited as collateral, tied up in a vault or part of a leveraged position, it hangs on a price source.

A simple ranking helps in assessing your own risk. Most exposed are leveraged positions, because there even a brief mispricing leads to a forced closure. Next come credit positions with collateral. Automated vaults sit behind those, because they usually do not liquidate immediately, though they can block access. At the bottom end is simply holding tokens.

What a compensation promise is worth

After incidents of this kind, projects frequently announce a reimbursement. Such a promise is initially a declaration of intent and not a claim you could enforce. Whether it is honoured depends on the project's finances and on whether anyone is liable at all. So do not count on a repayment when you decide whether to let a remaining position run. The earlier oracle attack on Ostium also shows how long clarifying such cases takes.

Oracle risk in a DeFi portfolio: what to take away

1. Check today which of your positions depend on a price source. Note for each protocol which oracle it uses, and look up whether that oracle is currently delivering data. For positions on perpetuals venues, the liquidation rules and price sources are collected in our comparison of perpetuals trading venues.
2. Separate what has to be tied up from what can sit free. Holdings that are not meant to earn a return do not belong in a protocol. Which device is suitable for that and what it costs is set out in our hardware wallet comparison.
3. Secure your evidence before you change anything. Screenshots of your positions, transaction numbers and timestamps are the only basis for a later complaint. If you find in the process that you need a leaner solution for smaller amounts anyway, our software wallet comparison helps with the choice.

The incident is an object lesson in a dependency that appears in no yield figure. A protocol can be cleanly programmed and audited several times over and still hang on a service whose failure paralyses it instantly. Anyone who thinks about that point before depositing has taken more away from August 29 than a damage figure. Further information from the provider is available on the Switchboard site.

(As of September 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)