{
  "story_id": "4b25dead3c26e25923ed8528840c2123",
  "desk": "drm3",
  "revision": 1,
  "published_at": "2026-09-03T04:46:52.000Z",
  "content_hash": "395d8ef14189dde0f2aa016d81cbbc49e44e56a7cef55b0960d59a8531eda242",
  "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs",
  "basis": {
    "headline": "Switchboard Oracle Compromise Triggers Liquidations and Frozen Vaults",
    "dek": "A compromise in Switchboard's Move implementations caused losses, liquidations, and access pauses across DeFi protocols on Aptos, Sui, IOTA, and Movement.",
    "prose": "Switchboard, an oracle provider, said contributors halted its deployments on Aptos, Sui, IOTA, and Movement after reports of a potential compromise in its Move-language implementations. [^1]\n\nFull Sail, a decentralized exchange on the Sui network, announced on September 1, 2026, that it is winding down operations after an attacker drained roughly $91,000 from three of its vaults on August 29. [^2]\n\nAt least three applications reported losses, freezes, or precautionary access restrictions following the Switchboard incident. [^3]\n\nFull Sail confirmed that its vaults lost funds and said deposits and withdrawals would remain paused until oracle integrity was restored and verified. [^4]\n\nVirtue, an IOTA credit protocol, said an attacker gained control of the signing keys used by all 14 oracles on Switchboard's IOTA mainnet queue and pushed IOTA's reported price to $10 million. [^5]\n\nFull Sail paused deposits and withdrawals after confirming the incident on August 29 and committed to returning funds to affected users while absorbing the shortfall. [^6]\n\nFull Sail stated that the attack was not an admin key compromise but involved direct liquidity pool positions, allowing the attacker to deposit funds and withdraw more than the deposit value once prices were restored. [^7]\n\nThe attacker exploited Switchboard production code that governs who can sign oracle price updates, adding a key they controlled to a live oracle to push prices roughly 100 times below market. [^8]",
    "cited": "[{\"statement\":\"Switchboard, an oracle provider, said contributors halted its deployments on Aptos, Sui, IOTA, and Movement after reports of a potential compromise in its Move-language implementations.\",\"source\":\"cryptoslate.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T14:30:15.000Z\",\"publisher_count\":1,\"sources\":[\"cryptoslate.com\"]},{\"statement\":\"Full Sail, a decentralized exchange on the Sui network, announced on September 1, 2026, that it is winding down operations after an attacker drained roughly $91,000 from three of its vaults on August 29.\",\"source\":\"beincrypto.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T04:46:52.000Z\",\"publisher_count\":1,\"sources\":[\"beincrypto.com\"]},{\"statement\":\"At least three applications reported losses, freezes, or precautionary access restrictions following the Switchboard incident.\",\"source\":\"cryptoslate.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T14:30:15.000Z\",\"publisher_count\":1,\"sources\":[\"cryptoslate.com\"]},{\"statement\":\"Full Sail confirmed that its vaults lost funds and said deposits and withdrawals would remain paused until oracle integrity was restored and verified.\",\"source\":\"cryptoslate.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T14:30:15.000Z\",\"publisher_count\":1,\"sources\":[\"cryptoslate.com\"]},{\"statement\":\"Virtue, an IOTA credit protocol, said an attacker gained control of the signing keys used by all 14 oracles on Switchboard's IOTA mainnet queue and pushed IOTA's reported price to $10 million.\",\"source\":\"cryptoslate.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-01T14:30:15.000Z\",\"publisher_count\":1,\"sources\":[\"cryptoslate.com\"]},{\"statement\":\"Full Sail paused deposits and withdrawals after confirming the incident on August 29 and committed to returning funds to affected users while absorbing the shortfall.\",\"source\":\"beincrypto.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T04:46:52.000Z\",\"publisher_count\":1,\"sources\":[\"beincrypto.com\"]},{\"statement\":\"Full Sail stated that the attack was not an admin key compromise but involved direct liquidity pool positions, allowing the attacker to deposit funds and withdraw more than the deposit value once prices were restored.\",\"source\":\"beincrypto.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T04:46:52.000Z\",\"publisher_count\":1,\"sources\":[\"beincrypto.com\"]},{\"statement\":\"The attacker exploited Switchboard production code that governs who can sign oracle price updates, adding a key they controlled to a live oracle to push prices roughly 100 times below market.\",\"source\":\"beincrypto.com\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T04:46:52.000Z\",\"publisher_count\":1,\"sources\":[\"beincrypto.com\"]}]",
    "kind": "news"
  },
  "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature",
  "receipt": null,
  "receipt_note": "this revision predates receipt-keeping (before v0.37.0); the filed row lives in the record",
  "generation_chain": {
    "wire": {
      "stream": "fountain_news",
      "story_id": "fab424e1e877a5de20581bfdb7a1d729",
      "thread_id": "83ea47e1f6ecc1b40dc9c074fcd56939",
      "thread_label": "Full Sail",
      "novelty": "UPDATE",
      "content_hash": "40c12361fbe9e52ee04c4b75c3fefc5f9a9a73ae18fac02feec432a985837106",
      "last_published_at": "2026-09-03T04:46:52.000Z",
      "read_receipt": {
        "slice_hash": "f9f3035973d114bd49ccdbd2bd68e303c9db55a43d24428022fc4d820fcecd8a",
        "cursor_from": "eyJ0cyI6IjIwMjYtMDktMDNUMDQ6MDk6MDAuMDAwMDAwWiIsImlkIjoiNjQ5MjI3ZDNmNWQyMGQ3NmI1ZTE1NGNhODNlMTI0ZTMiLCJ2IjoiMSJ9",
        "cursor_to": "eyJ0cyI6IjIwMjYtMDktMDNUMDU6MjI6MTQuMDAwMDAwWiIsImlkIjoiZDhmODAzZGZlMTljOTNjMmQ4YTY2NjhhZDIzOTA4ZTMiLCJ2IjoiMSJ9",
        "view": "v_fountain_news",
        "view_version": "1",
        "row_count": 100,
        "window_days": 3,
        "bytes_scanned": 12568115,
        "credits": 8,
        "price_per_100_rows": 8,
        "sig": "8Mw68pWWyK8mEkYDhz2CKBOEm38RSbCwr1_j9AjSpNI9R5VmWb29kk474JcUyYIA_ePRF93CMmJUhdHQWL2IBQ",
        "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE",
        "signer_path": "lakehouse/data-extract/v1",
        "alg": "Ed25519",
        "signed": true
      }
    },
    "written_at": "2026-09-03T06:50:58.977Z"
  },
  "cited_facts": [
    {
      "statement": "Switchboard, an oracle provider, said contributors halted its deployments on Aptos, Sui, IOTA, and Movement after reports of a potential compromise in its Move-language implementations.",
      "source": "cryptoslate.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T14:30:15.000Z",
      "publisher_count": 1,
      "sources": [
        "cryptoslate.com"
      ]
    },
    {
      "statement": "Full Sail, a decentralized exchange on the Sui network, announced on September 1, 2026, that it is winding down operations after an attacker drained roughly $91,000 from three of its vaults on August 29.",
      "source": "beincrypto.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T04:46:52.000Z",
      "publisher_count": 1,
      "sources": [
        "beincrypto.com"
      ]
    },
    {
      "statement": "At least three applications reported losses, freezes, or precautionary access restrictions following the Switchboard incident.",
      "source": "cryptoslate.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T14:30:15.000Z",
      "publisher_count": 1,
      "sources": [
        "cryptoslate.com"
      ]
    },
    {
      "statement": "Full Sail confirmed that its vaults lost funds and said deposits and withdrawals would remain paused until oracle integrity was restored and verified.",
      "source": "cryptoslate.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T14:30:15.000Z",
      "publisher_count": 1,
      "sources": [
        "cryptoslate.com"
      ]
    },
    {
      "statement": "Virtue, an IOTA credit protocol, said an attacker gained control of the signing keys used by all 14 oracles on Switchboard's IOTA mainnet queue and pushed IOTA's reported price to $10 million.",
      "source": "cryptoslate.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-01T14:30:15.000Z",
      "publisher_count": 1,
      "sources": [
        "cryptoslate.com"
      ]
    },
    {
      "statement": "Full Sail paused deposits and withdrawals after confirming the incident on August 29 and committed to returning funds to affected users while absorbing the shortfall.",
      "source": "beincrypto.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T04:46:52.000Z",
      "publisher_count": 1,
      "sources": [
        "beincrypto.com"
      ]
    },
    {
      "statement": "Full Sail stated that the attack was not an admin key compromise but involved direct liquidity pool positions, allowing the attacker to deposit funds and withdraw more than the deposit value once prices were restored.",
      "source": "beincrypto.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T04:46:52.000Z",
      "publisher_count": 1,
      "sources": [
        "beincrypto.com"
      ]
    },
    {
      "statement": "The attacker exploited Switchboard production code that governs who can sign oracle price updates, adding a key they controlled to a live oracle to push prices roughly 100 times below market.",
      "source": "beincrypto.com",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T04:46:52.000Z",
      "publisher_count": 1,
      "sources": [
        "beincrypto.com"
      ]
    }
  ],
  "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true."
}