Full Sail, a decentralized finance (DeFi) protocol built on the Sui blockchain, says it is shutting down after a security incident tied to an oracle provider. In a public update on Tuesday, the team announced it would disable new deposits and stop liquidity provider (LP) reward claims as part of its wind-down process, with the priority focused on compensating affected users.

According to Full Sail, the decision follows losses stemming from issues in the protocol’s automated vaults. The team linked the incident to a suspected compromise of Switchboard’s oracle infrastructure, which is responsible for feeding price and other data into on-chain systems.

Key takeaways

• Full Sail is winding down permanently and has disabled new deposits and LP reward claims immediately.
• Withdrawal-only mode will follow after the protocol completes final security checks.
• Full Sail attributes the incident to Switchboard oracle infrastructure after a suspected oracle compromise affected automated vaults.
• User compensation is the stated priority, with remaining protocol liquidity intended to cover refunds and the team seeking to address any shortfall.

A shutdown triggered by oracle-linked vault problems

The wind-down comes after a sequence of updates beginning with Full Sail’s first disclosure on Saturday. In an X post, the protocol said it had confirmed that funds were lost and paused deposits and withdrawals while investigations were underway.

Full Sail later clarified that an attacker removed roughly $91,000 from three of its vaults. The incident was associated with its automated vault system—an architecture that typically relies on oracle inputs to operate correctly and safely.

At the time, Switchboard also addressed the issue. In its own X post on Saturday, Switchboard said it was investigating a potential compromise of its Move-based implementations and that it had halted its network on Aptos, Sui, IOTA, and Movement. That multi-chain pause suggests the suspected issue was broader than a single deployment, increasing the likelihood that multiple oracle-consuming applications could be impacted.

Broader collateral stress seen in connected lending markets

While Full Sail reported losses in its own vaults, other ecosystem activity indicated the risk may have spilled beyond one protocol. Virtue, a stablecoin lending platform connected to the IOTA ecosystem, said it experienced separate losses—reporting about $455,000 and stating that the backing of its VUSD stablecoin had been impaired.

These reports matter for DeFi users because stablecoin lending and collateralized borrowing can be highly sensitive to oracle correctness. If oracle feeds are manipulated—or become unreliable—vaults and lending positions may not behave as expected, potentially leading to rapid loss of collateral value or exploitable liquidation conditions.

Even where a protocol does not directly hold the impacted chain’s liquidity, an oracle-linked failure can still propagate through the DeFi stack via shared infrastructure assumptions.

Immediate actions: deposits frozen, rewards paused, then withdrawals

In Tuesday’s announcement, Full Sail outlined concrete steps for winding down operations. The protocol said it would:

• Disable new deposits right away.
• Stop LP reward claims immediately.
• Move regular pools to withdrawal-only mode after completing final security checks.

This approach is typical for protocols attempting to prevent further damage during incident response. By freezing new inflows and halting reward distribution, teams reduce the surface area for exploitation and lower incentives for users to interact with a system whose safety assumptions may still be under review.

Full Sail also stated that it expects to publish detailed withdrawal and claim instructions within the coming days. For users, those instructions will likely determine how compensation will be processed and how remaining assets will be allocated—especially important when a protocol has suffered partial losses or when multiple user classes may be involved.

Compensation plan and remaining uncertainty

Full Sail said it will use remaining protocol-owned liquidity to compensate users. It also indicated that the team will cover any shortfall so community depositors are repaid first.

While that statement is intended to reassure affected users, the final outcome depends on several variables that readers should watch closely: the total amount recoverable from compromised vaults, whether any portion of the removed funds can be retrieved, and how the protocol’s remaining liquidity compares to users’ claims.

As with many DeFi incident responses, the next milestone will be operational transparency. Full Sail’s promised withdrawal and claim instructions should clarify timelines, eligibility, and the mechanics of repayment—elements that often determine whether users can recover capital smoothly or face extended delays.

More broadly, the incident underscores a recurring industry tension: oracle providers sit at a critical junction between on-chain logic and real-time data. When an oracle infrastructure compromise triggers cross-chain actions—as Switchboard described by halting on several networks—protocols that depend on those feeds may face emergency shutdown decisions even if the core smart contract code is unchanged.

For now, users should focus on Full Sail’s next update for withdrawal and claim procedures, while monitoring further disclosures on the suspected Switchboard compromise and any downstream effects on other oracle-dependent protocols.

SEC Chair Paul Atkins has said the CLARITY Act could advance through the Senate within two weeks as lawmakers prepare for a key procedural vote on Sept. 15.

Atkins expects CLARITY Act movement within two weeks

SEC Chair Paul Atkins said in a post that he hopes the Senate will move the CLARITY Act forward within the next two weeks, giving the delayed crypto market structure bill another chance to reach President Donald Trump’s desk.

Speaking about the agency’s work on digital asset rules, Atkins said the SEC is preparing a framework that could operate alongside the legislation. The proposal includes exemptions for certain fundraising and other crypto activities, with the agency collecting public comments before deciding on final rules.

Atkins said the SEC can use its existing authority under federal securities laws if Congress fails to complete the bill. Legislation would offer a firmer legal base, however, because a future commission could find it harder to reverse rules grounded in an act of Congress.

“Our goal is to get them adopted, to get them taken up by the industry,” Atkins said.

The SEC chair added that “what we really do need though is statutory grounding,” presenting congressional action as the more durable route for setting U.S. crypto rules.

Atkins’ comments come before a scheduled cloture vote on Sept. 15. According to the official Senate schedule, the motion involving H.R. 3633 will ripen at 2:15 p.m. ET.

A cloture vote is not a final vote on the legislation. Instead, senators will decide whether to end the procedural delay and move toward floor debate, amendments and eventual passage. The motion needs 60 votes, requiring support from both parties in the closely divided chamber.

Senate Majority Leader John Thune filed cloture on the motion to proceed before lawmakers left Washington for their August recess. Failure to secure 60 votes would prevent the chamber from moving directly to a final vote under the current schedule.

CLARITY Act faces a narrow congressional timetable

Questions over the bill’s prospects have continued despite Atkins’ two-week estimate, as Congress approaches a period in which the midterm elections could take up more of the Senate calendar.

SALT CEO John Darsie said he remains doubtful that lawmakers will finish the measure this year.

“Personally, I’m somewhat bearish on the CLARITY Act passing,” Darsie said, citing the political timetable before the midterm elections.

Kalshi traders placed the probability of the legislation becoming law in 2026 at 49%, leaving the prediction market almost evenly divided. The contract represents traders’ expectations rather than an independent assessment of the bill’s legal or political prospects.

Earlier delays have already narrowed the available window. The House passed the legislation by a 294-134 vote in July 2025, while the Senate Banking Committee advanced its version 15-9 in May 2026. Two Democrats joined the committee’s 13 Republicans, according to the committee’s official record.

As crypto.news previously reported, Republicans hold 53 Senate seats but cannot reach the cloture threshold alone. Opposition or uncertainty among several Republican senators would require party leaders to secure more Democratic votes than the two received during the Banking Committee stage.

The bill’s path became more difficult in August when senators left Washington without holding a floor vote. Senate leaders instead placed the procedural motion on the September calendar, keeping the legislation alive while leaving little room for another delay.

Prediction-market estimates have varied sharply during the year. Polymarket traders gave passage an 82% chance in February, but the figure had dropped to about 16% by early August after the Senate adjourned without acting on the bill, according to earlier passage estimates.

Kalshi’s more recent 49% figure points to a different assessment among users of that platform. Neither contract determines how senators will vote, and prices can change as negotiations continue.

The bill would split SEC and CFTC authority

The CLARITY Act would establish federal rules for deciding when a digital asset falls under the SEC or the Commodity Futures Trading Commission. It would also create registration requirements for crypto companies and apply anti-money laundering obligations to covered businesses.

Under the proposed structure, the SEC would retain authority over digital assets treated as securities and investment contracts. The CFTC would receive authority over qualifying digital commodities and parts of the spot market that currently sit outside its traditional derivatives mandate.

For U.S. investors and crypto businesses, the division would affect which regulator oversees token trading, disclosures, exchange registration, and customer protections. The framework could also give companies a defined process for showing when a blockchain network has reached the conditions needed for a token to move from securities oversight to commodity treatment.

The current legislative framework separates digital assets into categories that include commodities, investment contract assets, and payment stablecoins. It also contains standards covering customer asset segregation, conflict disclosures, and compliance by trading platforms.

Several disputes remain unresolved. Senators have debated whether companies should be allowed to pay rewards or interest to stablecoin holders, how the bill should protect decentralized finance developers, and whether federal ethics rules should cover public officials with crypto holdings or business interests.

A revised Senate Banking Committee draft permitted rewards linked to customer activity while restricting passive yield paid solely for holding a stablecoin. The same version did not contain the ethics language sought by some lawmakers, according to a May draft review.

Banking groups and crypto companies have taken different positions on the stablecoin provisions. Some banks have argued that reward-bearing stablecoin products could draw deposits away from regulated lenders, while crypto firms have said activity-based rewards should remain available.

SEC prepares a regulatory fallback

Alongside the congressional negotiations, the SEC has continued working on rules that do not depend on the CLARITY Act becoming law. Atkins said the commission can pursue exemptions and other measures using powers already available under securities legislation.

The SEC proposed Regulation Crypto Assets on Aug. 18, including a $5 million exemption for startups, a $75 million fundraising exemption, and a safe harbor that could allow certain tokens to leave securities status after meeting specified conditions, according to a comparison of both frameworks.

Agency rules would not carry the same permanence as legislation. A later SEC leadership team could amend or remove them through another rulemaking process, which is why Atkins has called for congressional backing.

The CFTC is preparing its own response to a possible legislative failure. CFTC Chair Michael Selig said the agency would continue developing crypto market rules regardless of the CLARITY Act’s outcome, including work within the commission’s existing authority.

At the SEC, a separate tokenization exemption could also return within weeks. The proposal would allow approved platforms to test blockchain-based securities products under limited relief from existing requirements, although legal questions about the commission’s authority previously delayed the measure.

The agency has also proposed updating transfer-agent rules written before blockchain-based share records became possible. The planned changes would address cybersecurity, operational safeguards, and the use of distributed ledgers to maintain ownership records and process securities transfers.

A Senate vote could shape US crypto regulation as SEC Chair Paul Atkins backs the CLARITY Act. Atkins expects lawmakers to advance the bill this month, despite delays and pressure from the approaching elections. The Senate plans a September 15 cloture vote, which could clear the way for debate and final action.

Atkins said the SEC is preparing rules that could work alongside the legislation. The agency is collecting comments on exemptions covering fundraising and digital asset activities. Meanwhile, Atkins said the SEC could use existing securities laws if Congress fails to establish a new framework.

The SEC chair supports the legislation because it could create a lasting legal structure for digital assets. Such rules could reduce uncertainty because future SEC leaders would face statutory boundaries. Consequently, the bill could shape how regulators approach crypto markets beyond the current administration.

Senate Vote Sets Up Clarity Act Test

The September 15 cloture vote represents an important procedural test for the market structure bill. A successful vote could end debate and allow senators to consider the legislation. However, lawmakers face limited time before election activity could reduce legislative momentum.

The CLARITY Act previously passed the House and later advanced through the Senate Banking Committee. An earlier attempt to bring the measure before the Senate failed to gain support. Therefore, the upcoming vote has become a measure of whether lawmakers can revive the bill.

Industry reactions also show mixed expectations about the legislation’s path through Congress. SALT CEO John Darsie has questioned whether lawmakers can finish the measure before the political calendar tightens. Prediction market Kalshi has placed the chance of enactment this year near 49%.

Clarity Act Defines Crypto Oversight

The proposed law would establish clearer responsibilities for the SEC and Commodity Futures Trading Commission. It would also create registration requirements for crypto companies and introduce anti-money laundering obligations. Those provisions would give digital asset firms a defined route.

The legislation still faces disputes over stablecoin rules and other policy issues. One debate concerns whether stablecoin holders should receive interest from their digital asset holdings. Lawmakers also discuss ethics rules involving public officials with digital asset interests.

The bill forms part of wider US asset regulation. Atkins has indicated that the SEC could introduce a tokenization innovation exemption soon. Additionally, the agency has proposed updated transfer agent rules for blockchain securities and digital share transfers.

Sec Advances Parallel Crypto Rules

The SEC’s separate initiatives could reshape market practices while Congress considers the CLARITY Act. Its exemptions address fundraising and other activities facing securities law requirements. Public comments could influence the final structure of those changes.

Atkins has argued that agency action can provide immediate relief under existing securities laws. However, legislation would give those changes legal support and could make them harder for future leaders to reverse. Hence, congressional action remains central to creating a durable framework for the crypto industry.

The vote will show whether lawmakers can overcome delays and move the bill forward. If the measure advances, negotiations could continue toward final congressional approval and presidential action. If it stalls again, the SEC may continue developing rules under its authority.

Thailand is tightening oversight of crypto transfers, including transactions involving self-custodial wallets, as it moves to align with global Anti-Money Laundering (AML) standards.

Thailand’s Securities and Exchange Commission (SEC) issued new Travel Rule regulations requiring digital asset operators to collect information about parties involved in crypto transfers, the regulator announced Wednesday.

The rules will take effect on Feb. 27, 2027, giving crypto businesses nearly six months to develop systems for transmitting, receiving and monitoring transaction information.

Thailand joins a growing global push to track who sends and receives crypto, as the Financial Action Task Force (FATF) estimated that 83% of surveyed jurisdictions had passed Travel Rule legislation as of 2026.

Self-custodial wallets face ownership checks

Under the new framework, Thai digital asset operators must verify the ownership or control of self-hosted, or self-custodial, wallets when customers send crypto to or receive it from those wallets.

Unlike wallets managed by centralized exchanges (CEXs) or custodians, self-custodial wallets give users direct control over the private keys needed to access their crypto.

Operators must also retain information accompanying every digital asset transaction for at least five years and make the records available for regulatory examination.

The requirements put more responsibility on crypto companies to identify the parties behind transfers, including those involving self-custodial wallets. Pornanong Budsaratragoon, secretary-general of Thailand’s SEC, said the rules aim to “reduce the risk of digital asset operators being used for money laundering and terrorist financing.”

Thailand moves from consultation to final rules

The final rules follow two rounds of public consultation this year, starting with proposed principles in March and a draft notification in June. The SEC said most stakeholders supported the proposals.

The Travel Rule comes as Thailand considers expanding access to other regulated crypto products. On Monday, the SEC proposed allowing intermediaries to offer retail investors access to certain crypto derivatives traded on regulated overseas exchanges.

Days earlier, the regulator advanced draft rules for spot Bitcoin and Ether exchange-traded funds (ETFs), while also seeking feedback on requirements for foreign digital asset custodians used by funds investing in crypto.

Magazine: Thailand’s 0% crypto tax. Bitcoin Red Team forced to use Chinese AI: Asia Express

U.S. federal law enforcement says it has helped disrupt a long-running cybercrime operation tied to cryptocurrency theft, working alongside international partners and private-sector cybersecurity experts. The Justice Department announced that the Sality malware and its botnet infrastructure were targeted in an effort spanning multiple countries.

According to the U.S. Justice Department, the operation involved Bulgarian, Hungarian and Romanian authorities, as well as partners including CrowdStrike and the Shadowserver Foundation. The department said Sality was used to compromise devices and facilitate theft of digital assets, with activity traced back to 2003.

Key takeaways

• The U.S. Justice Department said it disrupted the Sality botnet and associated malware in an international takedown effort.
• CrowdStrike linked the scheme to clipjacking behavior that targets cryptocurrency wallet addresses copied to a clipboard.
• U.S. officials and CrowdStrike described a peer-to-peer botnet of roughly 15,000 infected computers checking connectivity every 40 minutes.
• CrowdStrike reported at least 12.1 million rubles (about $150,000) stolen over an eight-year period tied to “never-spent” digital assets, with a peak value around January 2025.

What the Justice Department says was targeted

In a Tuesday notice, the U.S. Justice Department stated that it had “disrupted the Sality botnet and malware” through a coordinated international operation. The department’s announcement names government agencies in Bulgaria, Hungary and Romania, while also citing private-sector support from CrowdStrike and the Shadowserver Foundation.

Officials said Sality malware was responsible for installing malicious code on compromised systems. They tied that activity to both cryptocurrency theft and broader cyberattacks. While the announcement frames the action as a disruption rather than a total elimination, the message is clear: the takedown interfered with the malware’s ability to coordinate with infected machines.

The announcement also underscores why botnets remain a key threat vector for the crypto sector. Malware operators can use compromised endpoints to manipulate users and move stolen assets, turning ordinary wallet operations—like copy-and-paste—into moments of vulnerability.

The clipjacking mechanism behind the crypto theft

CrowdStrike provided technical detail on how actors behind Sality allegedly harvested cryptocurrency payments. In a post describing the operation, the company said the criminals used EggJagger, described as a “clipjacking tool” that monitors a device’s clipboard for cryptocurrency wallet addresses.

The method is designed to be difficult for victims to notice. When a user copies a Bitcoin or Ethereum address to send funds, CrowdStrike said the malware can silently replace that address with one controlled by the attacker. In its explanation, CrowdStrike said that “funds are redirected” when the victim pastes the altered destination address into a payment.

This matters for investors and users because it highlights a persistent class of wallet-related risk: attacks do not always require users to install obviously malicious software. Instead, they can compromise normal device behavior and quietly reroute transactions.

Scale and operational details described by CrowdStrike

CrowdStrike said that in the eight years preceding the disruption, the operators behind Sality used EggJagger to steal at least 12.1 million rubles—about $150,000 in cryptocurrency—by redirecting copied wallet addresses. The company also reported that the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

Officials and CrowdStrike described a network architecture built around peer-to-peer communication. In their account, around 15,000 infected computers formed a botnet that would check whether systems were online every 40 minutes. The operational cadence is notable: such periodic communication patterns often help attackers maintain control while keeping command-and-control traffic manageable.

As a result of the authorities’ efforts, CrowdStrike and U.S. officials said the criminals “lost the ability to communicate with infected machines.” That shift is a practical outcome of takedowns: even if some malware remains on endpoints, the attacker’s capacity to coordinate, update tactics, or manage automated theft can be severely reduced.

Why this takedown is significant for crypto security

Criminal ecosystems built around clipboard manipulation reflect a larger reality for the cryptocurrency space: user behavior and device integrity are often the weakest links. The Sality/EggJagger case demonstrates that even basic actions—copying addresses—can become an attack surface when malware is present.

For defenders, the episode reinforces the importance of hardening endpoints and monitoring for suspicious clipboard activity, not just traditional signs of malware infection. For crypto users, it strengthens the case for safer transfer practices such as verifying addresses through trusted channels and being cautious when transactions are prepared on potentially compromised systems.

From a broader market perspective, disruptions like this can reduce the flow of stolen assets—though the exact immediate impact is hard to quantify from public reporting alone. What is clear from the announcements is that law enforcement and security researchers were able to interfere with a mature cybercrime setup that had been active for years.

Looking ahead, readers should watch for two things: whether additional reporting clarifies how many victims were impacted in total, and whether security teams publish indicators or mitigation guidance connected to Sality and EggJagger techniques. As the ability to communicate with infected machines has been disrupted, the more enduring question is how quickly attackers will attempt to reconstitute similar clipboard-stealing capabilities elsewhere.