Loopscale pauses protocol after week of 30,000 daily malicious API requests

What happened

Loopscale, a Solana-based lending protocol, has temporarily suspended operations after its application programming interfaces received more than 30,000 malicious requests per day during a campaign that ran for about a week. In a statement dated Nov. 5, the team said its security systems had detected a significant escalation in the activity and that it paused the protocol immediately to limit the impact. Crypto.news and Blockonomi both reported the halt.

The requests were directed at Loopscale's SOL and USDC Genesis vaults, which hold assets deposited by users of the lending platform. In an update on the protocol's Discord channel, a team member said the incident was part of a targeted campaign against the older Genesis vaults, that those vaults had been made whole and that no users had incurred losses. The team said deposited funds remained secure throughout the suspension.

Loopscale described the campaign as the work of a sophisticated actor. It has not disclosed how much was at risk during the week or explained how the attacker tried to compromise the vaults. The team said it had identified four addresses connected to the suspicious activity, two in Solana format and two in Ethereum-compatible format, and that it is working with federal law enforcement and security professionals. It has not named a suspected attacker or said which agencies are involved.

Normal operations will stay paused while the team establishes the full scope of the incident and adds further security measures. Loopscale intends to reopen its interface shortly and is working to restore loan repayment functionality as soon as possible, arguing that borrowers could otherwise face unexpected liquidations while lending is unavailable. Reopening the interface will not amount to a full resumption, which the team says depends on completing its security review. No timetable has been provided.

Why it matters

Repayment access matters because borrowers on decentralized lending markets post cryptocurrency as collateral and can be liquidated if its value drops below a required threshold. Repaying reduces outstanding debt and helps users keep positions within collateral limits, so a suspension that blocks repayments leaves them exposed during volatile markets.

The incident also involves vaults that were at the centre of an earlier pricing exploit in April 2025, and it adds to a run of DeFi security problems that have led protocols to pause first and investigate afterwards.

What the data shows

Loopscale says its APIs absorbed more than 30,000 malicious requests a day over the past week and that four addresses have been linked to the activity. The April 2025 breach drained roughly $5.8 million, including about 5.7 million USDC and 1,200 SOL, from the same SOL and USDC vaults. The attacker later returned the funds under an arrangement offering a 10% whitehat bounty of about 3,947 SOL and immunity from legal action, with the remaining 19,999 SOL sent back to a Loopscale-controlled wallet by April 28.

A CertiK report cited by crypto.news estimated that hacks and scams caused $364 million in losses in April 2025, with about $18.2 million recovered across affected projects. More recently, Premia Labs lost $464,600 on Nov. 1, 2026, in an exploit that reportedly used flash loans and manipulated options pools on Arbitrum.

Background

The April 26, 2025 exploit stemmed from a weakness in the protocol's token pricing mechanism, specifically manipulation of pricing for RateX principal tokens, crypto.news reported. Depositors in the SOL and USDC vaults were affected, while borrowers and users of other lending functions were not directly affected. Loopscale suspended its markets and restricted withdrawals, then restored services in stages, reopening loan repayments and position-closing before vault withdrawals. Blockonomi reported that the same Genesis vaults featured in a second pricing-related episode, making this the second such incident since April 2025.

What is still unclear

Several details remain undisclosed: the amount of funds affected during the campaign, the method used against the vaults, which federal agencies are assisting and any timeline for resuming normal service.

Blockonomi also reported that researchers found a collateral-pricing problem involving kySOL, a liquid staking token, in which a single kySOL token was treated as zBTC collateral and a decimal mismatch sharply inflated its recorded value, allowing a borrower to withdraw 4,597 SOL that was then bridged away from the protocol. The reports did not specify how that finding relates to the API campaign or whether it is the subject of the current investigation.

What to watch

Readers should watch for the reopening of Loopscale's interface, the return of repayment and position-closing functions, and any statement on the scope of the review and the extra security measures promised before a full restart. Also relevant is whether law enforcement action follows from the four flagged addresses, and whether the team publishes further detail on how the attack was attempted. Blockonomi reported that Loopscale said it would keep sharing relevant information and material updates as they become available.

Questions readers ask