Virtue (Switchboard oracle keys) hack — August 2026
Incident facts
| Date of incident | (approximate) |
|---|---|
| Target type | Stablecoin or yield protocol |
| Loss | $455,000Price at time of incident |
| Method | Private key compromiseThe signing keys of all fourteen oracles on Switchboard's IOTA mainnet queue came under the attacker's control, letting IOTA be reported at $10m; how the keys were obtained has not been disclosed |
| Chains | Other |
| Outcome | Unresolved |
What happened
Virtue, a stablecoin lending protocol on IOTA, lost about $455,000 on or around 29 August 2026 after the price oracle it relied on was taken over. An attacker gained control of the signing keys of all fourteen oracles on Switchboard's IOTA mainnet queue and reported IOTA's price as $10m. Against that price the attacker deposited a single IOTA and minted about 4.94m VUSD, Virtue's stablecoin. The feed was later pushed close to zero, which triggered 47 liquidations across 45 users.
The $455,000 is Virtue's own figure, as reported by Cointelegraph. The 4.94m VUSD is the face value of what was minted, not a loss, and could never have been sold at par. The DefiLlama dataset lists about $894,500. Virtue froze borrowing, repayment, deposits, withdrawals, liquidations and flash loans, and warned that VUSD was materially undercollateralised while remediation was pending.
The fault was not in Virtue's contracts. Switchboard halted its Move-based deployments on Aptos, Sui, IOTA and Movement after reports of a potential compromise of those implementations, while its Solana feeds kept running. It has not said how the keys were obtained. The same incident cost Full Sail on Sui about $91,000 from three vaults, below this registry's threshold. Full Sail is winding down and says it will use protocol-owned liquidity, and cover any shortfall itself, so that depositors are repaid first.
Sources
- CointelegraphSecondary · retrieved 2026-09-10
- CryptoSlateSecondary · retrieved 2026-09-10
- CoinpaprikaSecondary · retrieved 2026-09-10
Changes to this entry
- Recorded twelve days after the incident, once a loss figure from Virtue itself had been reported; earlier sweeps left it out because no dollar figure had been published. The amount is Virtue's own estimate of about $455,000, not the face value of the 4.94m VUSD minted and not DefiLlama's $894,500. The date is marked approximate: publishers date it 29 August, the DefiLlama dataset 28 August.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Virtue (Switchboard oracle keys) hack — August 2026", iTokenly, accessed 2026-09-10, https://itokenly.com/hacks/virtue-switchboard-oraclehttps://itokenly.com/hacks/virtue-switchboard-oraclePermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.