SKN | Sui DeFi Protocol Full Sail to Wind Down After $91,000 Switchboard-Linked Security Incident

Key Points:

• Full Sail will shut down after an attacker removed approximately $91,000 from three automated vaults following a suspected Switchboard oracle compromise.
• The Sui-based DeFi protocol has disabled new deposits and LP reward claims, while regular pools are moving toward withdrawal-only operation.
• Full Sail plans to use its remaining protocol-owned liquidity to compensate affected users and says the team will cover any remaining shortfall.

Full Sail, a decentralized finance protocol operating on the Sui blockchain, is winding down after a security incident linked to a suspected compromise of oracle infrastructure resulted in approximately $91,000 in losses. The shutdown highlights the risks that DeFi protocols face when automated vault strategies depend on external data providers and underscores the importance of resilient oracle infrastructure in blockchain-based financial applications.

Full Sail announced Tuesday that it had immediately disabled new deposits and liquidity provider reward claims. Regular pools are expected to transition into withdrawal-only mode after final security checks, with user compensation identified as the protocol’s primary priority.

Switchboard incident triggers Full Sail shutdown

The incident emerged last week after Full Sail’s automated vaults were affected by a suspected compromise involving Switchboard, an oracle provider used across blockchain applications.

Full Sail initially paused deposits and withdrawals while investigating the event and later confirmed that an attacker had removed approximately $91,000 from three vaults.

Switchboard separately disclosed that it was investigating a potential compromise involving its Move-based implementations and temporarily halted its network across Aptos, Sui, IOTA and Movement. The incident therefore extended beyond a single application, affecting infrastructure that multiple blockchain ecosystems rely on for data feeds and automated operations.

For DeFi protocols, oracle infrastructure is particularly important because smart contracts frequently depend on externally supplied information to determine asset prices, collateral values and other conditions. A compromised or manipulated data feed can therefore create opportunities for attackers even when the underlying protocol’s own contracts remain intact.

Full Sail prioritizes user compensation

Rather than attempting to continue operating after the incident, Full Sail said it would wind down the protocol.

The team plans to use its remaining protocol-owned liquidity to compensate affected users. If that liquidity is insufficient, Full Sail said the team will cover the shortfall so community depositors are repaid first.

The protocol is expected to publish detailed withdrawal and claim instructions within the coming days. Until then, users face a transition period in which new deposits and LP reward claims remain disabled while security checks are completed.

The approach reflects the difficult economics of operating a DeFi protocol after a security breach. Even relatively contained losses can undermine confidence in automated vault strategies, particularly when the incident originates from infrastructure outside the protocol’s direct control.

Broader impact across DeFi

Full Sail was not the only protocol affected by the Switchboard incident. Virtue, a stablecoin lending protocol on IOTA, separately reported approximately $455,000 in losses and said the backing of its VUSD stablecoin had been impaired.

Combined, the reported incidents illustrate how vulnerabilities in shared blockchain infrastructure can spread across multiple applications and networks.

For Sui’s DeFi ecosystem, Full Sail’s shutdown is another reminder that protocol security extends beyond smart-contract code. Oracle dependencies, cross-chain infrastructure and operational controls can all become potential points of failure.

The immediate focus will be on whether Full Sail can fully reimburse affected depositors and execute an orderly withdrawal process. Longer term, the incident may increase scrutiny of oracle architecture and risk-management practices across DeFi, particularly for automated vaults where inaccurate external data can quickly translate into financial losses. For users and developers, the episode reinforces the importance of understanding not only a protocol’s smart contracts but also the infrastructure those contracts depend upon.