Loopscale pauses operations after sustained attack on its Genesis Vaults

Solana logo, official brand asset from solana.com/branding. Alpenglow is a Solana consensus upgrade.

The Solana lending protocol says no user deposits were lost and affected vaults were made whole after a week of malicious probing

Thu 5 Nov 2026 · 06:37 EST · 3 min read

In Security

Loopscale has hit the brakes. The Solana-based lending protocol paused all activity after what it described as a sustained, sophisticated attack campaign aimed at its SOL and USDC Genesis Vaults.

No user deposits were lost, and the affected vaults were made whole.

What happened at Loopscale

The pause was announced on November 5, 2026. Loopscale framed it as a precautionary move rather than a reaction to a completed breach.

The attack campaign involved more than 30,000 malicious API requests per day over the prior week. Those requests targeted the protocol’s SOL and USDC Genesis Vaults.

Loopscale says it is now working with federal law enforcement. The team has also identified four wallet addresses it associates with the attack.

Operations will stay paused while the protocol runs further assessments. Loopscale is also weighing additional security hardening measures before turning things back on.

A familiar target

The Genesis Vaults have been here before. On April 26, 2025, an attacker drained approximately 5.7 million USDC and 1,211.4 SOL from the same vaults.

That exploit worked by manipulating the pricing logic for RateX principal tokens. Principal tokens represent the underlying value of a yield-bearing asset, separated from the yield it generates. If a lending protocol misjudges what that collateral is worth, an attacker can borrow far more than they should.

The news moving money, markets, and the world—before your day starts.

Daily. Free. Join 34,000+ readers across crypto, finance, and policy.

We respect your privacy. Unsubscribe anytime.

Loopscale paused operations then, too. The protocol subsequently recovered the drained funds, and users did not end up with net losses.

The team followed up with code reviews and published a post-mortem walking through how the recovery played out. Protocol functions, including repayments, were progressively switched back on after security reviews.

Who Loopscale is

Loopscale launched publicly on April 10, 2025. That means its first major exploit arrived barely more than two weeks after launch.

Despite that rocky start, the protocol has grown quickly. It currently holds approximately $85–$88 million in total value locked, or TVL, the standard measure of how much capital users have parked in a DeFi platform.

Loopscale specializes in fixed-rate, overcollateralized loans. Its design also sets it apart from many DeFi lenders. Instead of pooling everyone’s liquidity into one big bucket, Loopscale uses an order book model that matches individual lenders and borrowers.

What this means for users and DeFi lending

For current Loopscale depositors, the immediate takeaway is reassuring on paper. Deposits are intact and the vaults have been made whole. The trade-off is access: while the protocol is paused, users cannot actively lend, borrow, or adjust positions in the usual way.

Loopscale now has two incidents tied to the same set of vaults. Its track record of recovering funds and avoiding user losses is genuinely strong.

The law enforcement involvement is worth watching. Identifying four wallet addresses gives investigators a starting point, and on-chain activity is permanently traceable even when identities are not.

Things to watch next include the timeline for reopening, the specific hardening measures the team adopts, and whether it publishes another detailed post-mortem as it did in 2025. Users will also want clarity on how functions like repayments will be restored, and in what order.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.