Loopscale suspends operations after week‑long malicious API attack on Genesis vaults

Loopscale, a Solana‑based decentralized lending platform, announced on November 5 that it has temporarily halted all protocol activity. The decision follows a week‑long campaign in which its APIs were bombarded with more than 30,000 malicious requests each day, specifically targeting the SOL and USDC Genesis vaults. According to a statement posted on the protocol’s Discord channel, the security incident involved the older Genesis vaults, but the team confirmed that those vaults have been made whole and that no user deposits were lost.

Attack details and immediate response

The malicious traffic was described by Loopscale as the work of a “sophisticated actor.” In response, the protocol immediately paused lending, borrowing, and repayment functions to limit potential damage. While the UI remains offline, the team said restoring loan repayment functionality is a priority to prevent borrowers from facing forced liquidations during market volatility. Loopscale also identified four addresses linked to the suspicious activity—two Solana addresses and two in an Ethereum‑compatible format—and is working with federal law‑enforcement and security experts as the investigation proceeds.

Background: prior exploit and recovery

The current incident follows a high‑profile exploit in April 2025, when an attacker manipulated the pricing of RateX principal tokens and drained roughly $5.8 million from Loopscale’s SOL and USDC vaults. Loopscale later recovered the funds after reaching an agreement with the attacker that included a 10 % white‑hat bounty and the return of nearly 20,000 SOL. The April breach prompted a staged restoration of services, with loan repayments and position‑closing functions reopened while withdrawals stayed restricted pending further security checks.

Next steps and what to watch

Loopscale has not set a definitive timeline for a full resumption of services. The protocol plans to bring its user interface back online once additional security measures are in place and the investigation clarifies the full scope of the attack. Stakeholders should monitor updates from Loopscale’s official channels for announcements on UI restoration, repayment functionality, and any further disclosures about the attacker’s methods or the involvement of law‑enforcement agencies.