Solana-based lending protocol Loopscale has paused operations after the Loopscale API attack, a weeklong campaign targeting its SOL and USDC vaults, Crypto News reported. In a November 5 statement, the team said its security systems had detected an escalation in activity.
The suspension affects a platform whose Genesis vaults hold user deposits, while borrowers face the loss of a way to manage their loans. Loopscale said in its statement that "All deposited user funds are secured," and Crypto News reported that the team considers restoring repayments urgent because borrowers could otherwise face unexpected liquidations.
How the Loopscale API attack unfolded
The Loopscale API attack involved more than 30,000 malicious requests a day over the preceding week, with the protocol describing the campaign as the work of a sophisticated actor. The requests went to Loopscale's application programming interfaces, or APIs.
According to The Cryptonomist, Loopscale said the rise in activity prompted it to pause the protocol immediately to limit the damage. The targeted SOL and USDC Genesis vaults hold assets deposited by users of the lending platform.
A team member confirmed in Loopscale's official Discord channel that the incident involved older Genesis vaults and that the investigation was continuing, Crypto News reported. The outlet said Loopscale had not disclosed how much money was affected or how the attacker tried to compromise the vaults.
The affected vaults have been made whole and no users suffered losses, according to the team. Separately, Crypto Briefing reported that Loopscale uses an order book to match individual lenders with borrowers rather than combining their liquidity in a single pool.
Addresses and investigation
As part of its response to the Loopscale API attack, the protocol identified four addresses associated with the suspicious activity. Two were Solana addresses, while the other two were in an Ethereum-compatible format.
Crypto Briefing reported that Loopscale published the four wallet addresses linked to the campaign. Loopscale also said federal law enforcement and security professionals were assisting its ongoing inquiry.
Crypto News reported that Loopscale had not publicly identified a suspected attacker or named the federal agencies involved. The investigation is continuing alongside work on the protocol's security and restoration plans.
Repayments and reopening
Following the Loopscale API attack, the protocol intends to bring its user interface back online shortly and is working to restore loan repayments as quickly as possible, Crypto News reported. The outlet said Loopscale had not given a specific timetable for those services.
The planned interface reopening will not by itself be a full restart. According to Crypto News, a return to normal operations depends on completion of the security review, while the team assesses the campaign's scope and adds protections.
Crypto News reported that the team regards repayments as a priority because borrowers could otherwise face unexpected liquidations during the suspension. In decentralized lending, borrowers typically put up cryptocurrency as collateral, the outlet said.
If collateral falls below a required threshold, a position can become eligible for liquidation, according to Crypto News. Repayments can reduce outstanding debt and help borrowers maintain their collateral requirements, making access to that function relevant to managing a loan.
Earlier vault exploit
Before the Loopscale API attack, the protocol suffered a separate exploit on April 26, 2025. The Cryptonomist reported that an attacker manipulated the pricing of RateX principal tokens and drained approximately $5.8 million.
Crypto News reported that the withdrawals included about 5.7 million USDC and 1,200 SOL. Crypto Briefing put the SOL amount at approximately 1,211.4, while also reporting a withdrawal of about 5.7 million USDC.
Depositors in the SOL and USDC vaults were affected by the April breach, whereas borrowers and users of other lending functions were not directly affected, according to Crypto News. Loopscale suspended its markets and restricted withdrawals while seeking to recover the assets.
Crypto News reported that under an agreement with the team, the attacker agreed to return the remaining funds for a 10% whitehat bounty. The arrangement offered the attacker about 3,947 SOL and legal immunity for cooperation, and by April 28, the remaining 19,999 SOL had been sent to a Loopscale-controlled wallet.
After that breach, Crypto News reported, Loopscale began a phased restoration of services. Repayments and position-closing functions were the first to return, but withdrawals from vaults stayed restricted while further security checks were pending. The current investigation is separate from that earlier exploit.
Conclusion
Loopscale has suspended its lending protocol after a weeklong campaign against its SOL and USDC Genesis vaults, while the team says user deposits remain safe. The investigation includes four addresses associated with suspicious activity and work with federal law enforcement and security professionals. The immediate next step is to bring the interface back and restore repayments, although Crypto News reported that no specific timetable has been given. A full return to normal operations remains subject to the security review, according to the outlet.
Frequently Asked Questions
Why did Loopscale pause its Solana lending protocol?
Crypto News reported that Loopscale suspended operations after a weeklong campaign targeting its SOL and USDC vaults. Each day during that period, the protocol's APIs received in excess of 30,000 malicious requests. Loopscale said its security systems detected an escalation in the activity in a November 5 statement.
Were Loopscale's SOL and USDC Genesis vault deposits lost?
Loopscale said deposited user funds were secured following the campaign. The team also said the affected vaults had been made whole and that no users suffered losses. Crypto News reported that Loopscale had not disclosed how much money was affected during the campaign.
When will Loopscale restore loan repayments?
Crypto News reported that Loopscale intends to reopen its interface shortly and is working to restore repayments as quickly as possible, but has not supplied a specific timetable. The outlet said the team considers repayments urgent because borrowers could otherwise face unexpected liquidations while normal operations are suspended.
How does the attack differ from Loopscale's April 2025 exploit?
The current campaign involved malicious API requests and targeted the SOL and USDC Genesis vaults. The earlier incident, on April 26, 2025, involved manipulation of RateX principal-token pricing and drained about $5.8 million, The Cryptonomist reported. Loopscale later reached a recovery agreement with the attacker, according to Crypto News.
