Full Sail, a decentralized finance (DeFi) protocol operating on the Sui blockchain, says it will shut down after a security incident tied to its oracle provider, Switchboard. The protocol’s decision follows confirmed losses linked to automated vault activity, prompting it to disable new deposits and liquidity provider reward claims.

In an announcement posted on X on Tuesday, Full Sail outlined a winding-down plan that starts with immediate restrictions and transitions regular pools into a withdrawal-only state after additional security checks. Full Sail positioned user compensation as its top priority and said it would publish withdrawal and claim instructions in the coming days.

Key takeaways

Full Sail is shutting down on Sui after losses connected to oracle infrastructure provided by Switchboard.
The protocol has already disabled new deposits and liquidity provider (LP) reward claims, moving affected pools toward withdrawal-only operations.
Full Sail previously disclosed a suspected compromise investigation and later said an attacker removed roughly $91,000 from three vaults.
Switchboard stated it halted its network on several chains, including Aptos, Sui, IOTA, and Movement, while investigating potential compromises.
Full Sail said it will use remaining protocol liquidity to compensate users and cover any shortfall so depositors are repaid first.

Protocol winds down after vault losses

Full Sail’s shutdown plan comes after a security incident last week that impacted the protocol’s automated vaults. According to Full Sail’s X posts, the problem surfaced after a suspected compromise of Switchboard’s oracle infrastructure, which the DeFi protocol relies on to support its vault and lending operations.

On Tuesday, Full Sail said it is immediately disabling new deposits and liquidity provider reward claims. It also indicated that “regular pools” will shift into withdrawal-only mode after final security checks. The company framed the operational shift as a necessary step to protect remaining funds while it prepares a clear path for users to retrieve assets.

Full Sail also said it will publish instructions for withdrawals and claim-related processes within the coming days. For investors and liquidity providers, that timing will be important: users typically need precise guidance on when pools reopen for withdrawals and how to submit any compensation claims, especially when protocols are decommissioned.

Timeline of the incident: disclosure, investigation, then confirmed losses

Full Sail first disclosed the incident on Saturday, stating it had paused deposits and withdrawals while it investigated the cause and confirmed a loss of funds. The early steps—pausing user flows while attempting to understand what happened—are common in DeFi security responses, particularly when the issue may relate to price feeds or other components that vaults depend on for automated execution.

Switchboard, Full Sail’s oracle provider, said in its own X update on Saturday that it was investigating a potential compromise of its Move-based implementations. In the same update, Switchboard reported halting its network on multiple chains, including Aptos, Sui, IOTA, and Movement—an action that suggests it was attempting to limit further risk while examining whether its oracle services were being manipulated.

As the investigation progressed, Full Sail later stated that an attacker removed about $91,000 from three of its vaults. While the amount is smaller than the total value at risk in some historical DeFi oracle incidents, the episode highlights how rapidly losses can propagate through protocols that automate vault behavior based on external data.

Broader spillover: related stablecoin lending losses

The fallout from the suspected oracle compromise was not limited to Full Sail. Virtue, a stablecoin lending protocol built on IOTA (and known for its VUSD stablecoin), separately reported losses after the incident. According to Virtue’s X post on Saturday, it saw approximately $455,000 in losses and said the backing of its VUSD stablecoin had been impaired.

This matters because it indicates a wider blast radius: if oracle infrastructure is compromised on multiple chains, any protocol using that infrastructure may be exposed, even if those protocols operate under different architectures or business models. In other words, the incident appears to be an ecosystem-level risk factor rather than an isolated failure inside one application.

Investors watching DeFi’s infrastructure layer may treat these reports as a reminder that oracle reliability—along with incident response discipline—is crucial for stablecoin-oriented systems as well as lending vaults.

How Full Sail plans to compensate users

Full Sail says it will use remaining protocol-owned liquidity to compensate affected users. It also added that the team will cover any shortfall so community depositors are repaid first. That pledge is especially relevant in shutdown scenarios, where the priority is typically to preserve user access to remaining funds and reduce uncertainty about repayment.

Full Sail also indicated that after final security checks, pools will be set to withdrawal-only mode. For users, this raises practical questions—such as whether each vault or pool will have its own withdrawal window or whether claims will be coordinated across pools—but Full Sail’s promised instructions should clarify the steps once published.

From an editorial perspective, the core theme is risk containment: by disabling deposits and LP reward claims immediately and focusing on withdrawals and compensation, the protocol is attempting to stop new inflows that could complicate accounting or increase exposure while it finalizes remediation.

What to watch next

Full Sail’s next critical update will be the timing and content of its withdrawal and claim instructions. Users and liquidity providers should closely follow those details as they may determine how quickly funds can be retrieved and how compensation will be calculated if any shortfalls must be covered by the team.