Loopscale, a Solana-based lending protocol, has paused all operations after what it described as a sustained and sophisticated attack campaign targeting its SOL and USDC Genesis Vaults. The pause was announced on November 5, 2026, and was framed as a precautionary measure rather than a response to a completed breach.
According to the protocol, no user deposits were lost, and the affected vaults were made whole.
Attack details
The attack campaign involved more than 30,000 malicious API requests per day over the prior week, all aimed at the SOL and USDC Genesis Vaults. Loopscale says it is now working with federal law enforcement and has identified four wallet addresses associated with the attack.
Operations will remain paused while the protocol conducts further assessments and considers additional security hardening measures before resuming activity.
Prior incident
The Genesis Vaults have been targeted before. On April 26, 2025, an attacker drained approximately 5.7 million USDC and 1,211.4 SOL from the same vaults. That exploit manipulated the pricing logic for RateX principal tokens, which represent the underlying value of a yield-bearing asset separated from its yield. By misjudging the collateral's worth, the attacker was able to borrow far more than they should have.
Loopscale paused operations then as well, later recovered the drained funds, and users did not suffer net losses. The team followed up with code reviews and published a post-mortem detailing the recovery. Protocol functions, including repayments, were progressively restored after security reviews.
About Loopscale
Loopscale launched publicly on April 10, 2025, meaning its first major exploit occurred just over two weeks after launch. Despite that rocky start, the protocol has grown quickly and currently holds approximately $85–$88 million in total value locked (TVL).
Loopscale specializes in fixed-rate, overcollateralized loans and uses an order book model that matches individual lenders and borrowers, rather than pooling liquidity into a single bucket like many DeFi lenders.
Implications for users
For current depositors, the immediate takeaway is that deposits are intact and the vaults have been made whole. However, while the protocol is paused, users cannot actively lend, borrow, or adjust positions in the usual way.
Loopscale now has two incidents tied to the same set of vaults, though its track record of recovering funds and avoiding user losses remains strong. The involvement of law enforcement is noteworthy, as the identification of four wallet addresses provides investigators with a starting point, and on-chain activity is permanently traceable even when identities are not.
Key things to watch next include the timeline for reopening, the specific hardening measures the team adopts, and whether it publishes another detailed post-mortem as it did in 2025. Users will also want clarity on how functions like repayments will be restored and in what order.
