Solana-based lending protocol Loopscale has temporarily suspended operations after a week-long campaign of malicious requests targeting its vaults. According to reports from Huo Xing Finance and Odaily Planet Daily, the protocol's APIs received more than 30,000 malicious requests per day during the sustained attack campaign. The team described the campaign as the work of a sophisticated actor and immediately paused protocol activity to limit the impact. The attacks specifically targeted the protocol's SOL and USDC Genesis Vaults, which hold assets deposited by users of the lending platform. As reported by Odaily Planet Daily, after the security system detected a significant escalation in attacks, the team promptly suspended protocol operations to mitigate impact.
Despite the security incident, Loopscale confirmed that no users suffered losses during the attack campaign. As reported by Huo Xing Finance on November 5, the affected vaults had been made whole and user deposits remained safe. According to the protocol's announcement, the team replenished the affected vaults and all user funds remain secure. The Odaily Planet Daily report confirms that all user deposits remain secure, with the affected SOL and USDC Genesis Vaults having been restored. The security incident was part of a targeted campaign against the protocol's older Genesis vaults, with the team continuing to investigate the incident and working to restore full functionality while maintaining that user deposits remain secure.
While normal operations remain suspended, Loopscale intends to reopen its user interface shortly and is working to restore loan repayment functionality as quickly as possible. The team identified four addresses associated with the suspicious activity, including two Solana addresses and two addresses in Ethereum-compatible format, as reported by Huo Xing Finance. Restoring repayments is a priority because borrowers could otherwise face unexpected liquidations while normal lending operations remain unavailable. According to Odaily Planet Daily, the protocol interface will be reopened soon, with repayment functions returning to mitigate liquidation risks. The planned reopening will not constitute a full resumption of operations, which remains conditional on completion of the security review and implementation of enhanced security measures.
The latest security incident follows an earlier breach in April 2025, when Loopscale lost approximately $5.8 million after an attacker exploited a weakness in the protocol's token pricing mechanism. As reported by crypto.news, the April 26 exploit involved manipulation of pricing for RateX principal tokens, allowing the attacker to withdraw approximately 5.7 million USDC and 1,200 SOL from the protocol's vaults. Following the breach, Loopscale reached an agreement with the attacker who accepted a 10% whitehat bounty in exchange for returning the remaining funds, with the recovery completed by April 28.
As part of its response, Loopscale is working with federal law enforcement and security professionals as the investigation continues. According to Huo Xing Finance and Odaily Planet Daily, the team is collaborating with CFTC agencies and security experts as the full scope of the attacks is understood. The protocol has disclosed the four associated addresses and has not publicly identified the suspected attacker or disclosed which federal agencies are involved in the investigation. The Odaily Planet Daily report indicates that Loopscale has shared four linked addresses and is collaborating with law enforcement and security firms to investigate the incident. The incident underscores the vulnerability of liquidity and crypto markets to coordinated threats, with Loopscale stating it will not resume normal operations until the full scope of the attacks is understood and additional security measures are implemented.
