Loopscale has temporarily halted operations after an API attack sent more than 30,000 malicious requests a day at the Solana-based lending protocol over the past week. In a November 5, 2026 statement, Loopscale said the campaign targeted its SOL and USDC Genesis vaults. Its team said the affected vaults had been made whole and users had suffered no losses.
Key takeaways
Loopscale paused activity following a week-long attack campaign.
The team says affected depositors suffered no losses.
Restoring repayments takes priority to protect borrowers from unexpected liquidations.
Federal law enforcement and security professionals are assisting the investigation.
Loopscale API attack targets older Genesis vaults
The attack focused on Loopscale’s SOL and USDC Genesis vaults, which hold user deposits. A team member confirmed through the protocol’s official Discord channel that the incident involved its older Genesis vaults.
According to Loopscale, its security systems picked up on a sharp rise in the attack activity, prompting the team to immediately paused activity in order to limit the damage. It described the attacker as a sophisticated actor.
“All deposited user funds are secured,” Loopscale said in its November 5 statement. The Discord update separately confirmed that the affected vaults had been restored in full, with no user losses.
Investigators identify four suspicious addresses
Loopscale identified four addresses associated with the suspicious activity: two Solana addresses and two in an Ethereum-compatible format. The protocol is working with federal law enforcement and security professionals on the investigation.
Normal operations remain suspended as the team assesses the incident’s scope and implements additional security measures.
Loan repayments take priority over a full reopening
As soon as possible, Loopscale intends to bring its user interface back online and get loan repayment functionality working again, since the team views repayments as urgent given that borrowers might otherwise be hit with unforeseen liquidations while the suspension is in effect.
Repayments let borrowers lower their debt and maintain collateral requirements. When that function is unavailable, users can lose access to a way of managing their positions during market volatility.
Reopening the interface will not amount to a full restart. A complete return to operations remains conditional on finishing the security review, while work to restore limited functionality continues alongside the investigation.
April exploit ended with asset recovery
The Loopscale API attack follows a separate exploit on April 26, 2025, when an attacker manipulated pricing for RateX principal tokens and drained approximately $5.8 million. The withdrawals comprised approximately 5.7 million USDC and 1,200 SOL.
Depositors within the SOL and USDC vaults were the ones impacted by that breach, while borrowers and those using other lending features remained unaffected. Loopscale suspended its markets and restricted withdrawals while pursuing recovery.
In the end, the attacker agreed to a 10% whitehat bounty as a condition for giving back what remained of the stolen assets. The arrangement offered approximately 3,947 SOL and immunity from legal action for cooperating with the recovery process. By April 28, 2025, the remaining 19,999 SOL had reached a Loopscale-controlled wallet, completing the recovery.
Services then returned in stages. Loan repayments and position closing reopened first, while vault withdrawals stayed restricted pending further security checks.
According to a CertiK security report, April 2025 saw roughly $364 million lost to crypto hacks and scams, of which about $18.2 million was eventually recovered by the projects involved. In a more recent incident, on November 1, 2026, Premia Labs lost $464,600 in an exploit where an attacker allegedly paired flash loans with manipulation of options pools to drain collateral from Arbitrum-based vaults.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.