Switchboard halts oracle services on 4 chains after compromise detected

Switchboard suspended oracle operations on Aptos, SUI, IOTA, and Movement on Aug. 29 after detecting a potential compromise.

The protocol halted services to prevent potentially manipulated price data from reaching DeFi applications on those networks, according to the announcement. Security firms CertiK, PeckShield, and Blockaid have been monitoring the situation, though no confirmed exploit has been publicly attributed to the incident as of press time.

The shutdown follows a string of oracle-related incidents in 2026. On Aug. 27, lending protocol Moonwell lost approximately $8.7 million after an attacker manipulated the price of the illiquid MAMO token on Base, borrowing real cbBTC against inflated collateral. That exploit followed a February oracle mispricing bug that left Moonwell with about $1.78 million in bad debt when Coinbase Wrapped ETH was incorrectly priced near $1.12 instead of roughly $2,200.

The broader crypto sector has suffered $3.63 billion in losses from 245 documented security incidents between January 2025 and July 2026, according to CoinGecko's 2026 State of Crypto Security Report. Infrastructure and supply-chain vulnerabilities accounted for more than $1.8 billion of those losses, making oracle and key-management failures the most damaging attack vector across centralized and decentralized platforms.

Oracle Concentration Risk

The Switchboard halt affects protocols on Aptos, SUI, IOTA, and Movement that rely on its price feed infrastructure for lending markets, derivatives, and other DeFi applications. Without functioning oracles, these protocols may be forced to pause operations or rely on fallback data sources, potentially creating liquidity gaps and widening spreads.

The incident highlights a structural weakness in DeFi: the concentration of oracle infrastructure. While protocols like Chainlink, Pyth, and Switchboard compete for market share, many applications depend on a single oracle provider for critical price data. When that provider goes down, the entire ecosystem built on top of it faces operational risk.

Audit Gaps and Market Impact

Moonwell's August exploit demonstrated how oracle manipulation can cascade. The attacker inflated MAMO's collateral price, borrowed 50.6 cbBTC, converted the proceeds into DAI, and consolidated the funds in a single wallet. The protocol set borrow caps to 1 wei across all Base Core Markets and cut MAMO and WELL supply caps to 1 wei to stop further bleeding. WELL fell about 13 percent and MAMO dropped roughly 9 percent within 24 hours.

The incident also raises questions about audit coverage. Roughly 60 percent of exploited platforms — 147 out of 245 — had undergone independent audits before being compromised, and those audited platforms accounted for nearly 88.5 percent of all stolen funds. However, only about 11 percent of incidents involved vulnerabilities within the actual scope of those audits, according to CoinGecko's report.

For Switchboard, the immediate priority is determining the scope of the compromise and whether any manipulated data was published before the halt. The protocol has not yet disclosed a timeline for resuming operations on the affected chains.

This article is for informational purposes only and does not constitute investment advice.