Loopscale Halts All Operations After Sustained Attack on Genesis Vaults

Loopscale paused all protocol activity on November 5, 2026, after a week-long attack campaign that pushed more than 30,000 malicious API requests per day against its SOL and USDC Genesis Vaults. The Solana-based lending protocol says no user deposits were lost and the affected vaults were made whole.

The company framed the shutdown as precautionary, not a response to a completed breach. It is now working with federal law enforcement and has identified four wallet addresses it links to the campaign.

What does the attack campaign look like?

The numbers are striking. Over the prior week, the attackers flooded Loopscale with more than 30,000 malicious API requests daily, targeting the two flagship vaults that hold SOL and USDC. Loopscale treated the pattern as sophisticated and sustained rather than opportunistic, and pulled the switch on all operations while assessments continue.

Operations stay paused until further reviews finish. The team is also weighing additional security hardening measures before restoring functionality, and it has handed the four identified wallet addresses to investigators as a starting point for tracing.

A second incident for the same vaults

This is not the Genesis Vaults' first brush with attackers. On April 26, 2025, an exploiter drained roughly 5.7 million USDC and 1,211.4 SOL from the same vaults — barely more than two weeks after Loopscale's public launch on April 10, 2025.

That earlier attack worked by manipulating the pricing logic for RateX principal tokens. Principal tokens represent the underlying value of a yield-bearing asset, separated from the yield it generates. When a lending protocol misjudges what that collateral is worth, an attacker can borrow far more than the position justifies.

Loopscale paused operations then, too. The protocol subsequently recovered the drained funds, and users ended up with no net losses. The team ran code reviews, published a post-mortem on the recovery, and progressively switched functions back on — including repayments — after security checks.

Who is Loopscale?

The protocol specializes in fixed-rate, overcollateralized loans on Solana. Its design departs from most DeFi lenders: instead of pooling all liquidity together, Loopscale runs an order book model that matches individual lenders with individual borrowers.

Despite the rocky start, growth has been quick. Loopscale currently holds approximately $85–88 million in total value locked, the standard measure of capital parked in a DeFi platform.

What does this change for users?

For depositors, the immediate picture is reassuring on paper. Deposits are intact and the vaults were made whole. The trade-off is access: while the protocol is paused, users cannot lend, borrow, or adjust positions in the usual way.

The law enforcement angle is worth watching closely. Four identified wallet addresses give investigators concrete leads, and on-chain activity remains permanently traceable even when identities are not yet known.

Loopscale now carries two incidents tied to the same set of vaults. Its record of recovering funds and shielding users from losses is genuinely strong — but repeated pauses test depositor patience and the protocol's operational resilience.

What comes next

The open questions are concrete: the timeline for reopening, the specific hardening measures adopted, and whether Loopscale publishes another detailed post-mortem as it did in 2025. Users will also want clarity on the order in which functions like repayments come back online. Until those assessments conclude, the protocol stays dark and depositors wait.