Loopscale halts operations after 30,000 daily malicious API requests

Solana-based lending protocol Loopscale has temporarily suspended operations after a week-long campaign of malicious requests targeting its SOL and USDC vaults, although the team says user deposits remain safe.

In a November 5 statement, Loopscale said its security systems detected a significant escalation in the attacks after the protocol’s APIs received more than 30,000 malicious requests per day over the past week.

The team described the campaign as the work of a sophisticated actor and said it immediately paused protocol activity to limit the impact. The attempts specifically targeted its SOL and USDC Genesis Vaults, which hold assets deposited by users of the lending platform.

According to an update on Loopscale’s official Discord channel, the security incident was part of a targeted campaign against the protocol’s older Genesis vaults. He reiterated that the affected vaults had been made whole and no users had incurred losses, while the team continued investigating the incident and working to restore full functionality.

Loopscale has not disclosed the amount of funds affected during the campaign or provided details about how the attacker attempted to compromise the vaults.

Normal operations will remain suspended while the team determines the full scope of the incident and introduces additional security measures.

Loopscale plans to restore repayments while investigating attacks

Although the protocol remains paused, Loopscale intends to reopen its user interface shortly and is working to restore loan repayment functionality as quickly as possible.

The team said restoring repayments is a priority because borrowers could otherwise face unexpected liquidations while normal lending operations remain unavailable.

In decentralized lending, borrowers typically provide cryptocurrency as collateral to secure loans. If the value of their collateral falls below the required threshold, their positions can become eligible for liquidation.

Repayments can help borrowers reduce their outstanding debt and maintain their collateral requirements. Restrictions on repayment functionality could therefore leave some users unable to manage their positions through the protocol during periods of market volatility.

Loopscale has not provided a specific timetable for restoring these services. The planned reopening of its interface will not constitute a full resumption of operations, which remains conditional on the completion of its security review.

As part of its response, the protocol identified four addresses associated with the suspicious activity, including two Solana addresses and two addresses in Ethereum-compatible format.

The team said it is working with federal law enforcement and security professionals as the investigation continues. It has not publicly identified the suspected attacker or disclosed which federal agencies are involved.

Loopscale previously recovered $5.8 million after April 2025 exploit

The latest security incident follows an earlier breach in April 2025, when Loopscale lost approximately $5.8 million after an attacker exploited a weakness in the protocol’s token pricing mechanism.

As crypto.news previously reported, the April 26 exploit involved the manipulation of pricing for RateX principal tokens, allowing the attacker to withdraw approximately 5.7 million USDC and 1,200 SOL from the protocol’s vaults.

The incident affected depositors in the SOL and USDC vaults, while borrowers and users of other lending functions were not directly affected.

Following the breach, Loopscale suspended its markets and restricted withdrawals while attempting to recover the stolen assets.

The team subsequently reached an agreement with the attacker, who accepted a 10% whitehat bounty in exchange for returning the remaining funds.

Under the arrangement, the attacker was offered approximately 3,947 SOL and immunity from legal action in return for cooperating with the recovery process.

By April 28, the remaining 19,999 SOL had been transferred back to a Loopscale-controlled wallet, completing the recovery of the stolen assets.

The protocol subsequently began restoring services in stages, initially reopening loan repayments and position-closing functionality while vault withdrawals remained restricted pending further security checks.

The April exploit was among several DeFi security incidents recorded that month. A subsequent CertiK security report estimated that cryptocurrency hacks and scams caused $364 million in losses during April 2025, with approximately $18.2 million recovered across affected projects.

More recently, another decentralized finance protocol, Premia Labs, suffered a $464,600 exploit on November 1, 2026, after an attacker reportedly used flash loans and manipulated options pools to withdraw collateral from vaults on Arbitrum.